diff --git a/runtime/history/NEWFI-260908-A-STAGINGEDGE-PUBLICINGRESS-WRITERPATH-RCA43.json b/runtime/history/NEWFI-260908-A-STAGINGEDGE-PUBLICINGRESS-WRITERPATH-RCA43.json new file mode 100644 index 00000000..778baa18 --- /dev/null +++ b/runtime/history/NEWFI-260908-A-STAGINGEDGE-PUBLICINGRESS-WRITERPATH-RCA43.json @@ -0,0 +1,38 @@ +{ + "schema_version": 1, + "channel": "homelab-runtime", + "command_id": "NEWFI-260908-A-STAGINGEDGE-PUBLICINGRESS-WRITERPATH-RCA43", + "status": "OK", + "rc": 0, + "host": "pve01", + "mode": "read-only", + "component": "newfi-stagingedge-public-ingress-router-live-writerpath-rca-v7", + "started_at_utc": "2026-09-08T18:29:28Z", + "finished_at_utc": "2026-09-08T18:29:28Z", + "reference_register_checked": true, + "reference_sha256": "5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d66", + "error_register_checked": true, + "error_register_sha256": "3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0", + "command_sha256": "5d37f67460c7ccdd0ae041b342d7b75e929bf60333a13dd1b206e2befe296a6f", + "duplicate_failed_command_blocked": false, + "block_reason": null, + "execution_started": true, + "change_declared": false, + "result_contract_valid": true, + "result_contract_status": null, + "result_contract_error": null, + "command_rc": 0, + "changes_made": false, + "rollback_started": false, + "rollback_restored": null, + "mutation_outcome": "NO_MUTATION", + "sanitized": true, + "secrets_included": false, + "private_addresses_included": false, + "raw_evidence_retained_locally": true, + "raw_evidence_sha256": "a94b0dc6cf0dca478f6e33ea44afab6abb54befb21a9f4e5a10e819be229e2ad", + "sanitized_output_sha256": "a94b0dc6cf0dca478f6e33ea44afab6abb54befb21a9f4e5a10e819be229e2ad", + "output_truncated_in_json": false, + "full_sanitized_output_url": "https://git.gram1.ru/.well-known/homelab-runtime/latest.txt", + "output": "ERROR_REGISTER_CHECK=OK\nREFERENCE_CHECK=OK\nAUTHORITY_CHECK_SCOPE=READABILITY_ONLY_INCIDENTS_NOT_CLOSED\nNEWFI43_RUNNER_SHA256=b248a4c32c9cc64e5747e7dce6c7fc0a23f5124a77c71ce72e27a81aceae9d2d\nNEWFI43_KNOWN_HOSTS_SHA256_BEFORE=ab01de61ca5030ad158f1aef377364100531473de1e10a529089174f6890d735\nNEWFI43_ERROR_ROUTER_CLUE_COUNT=13\nNEWFI43_ERROR_ROUTER_CLUES=[{\"line\":171,\"text\":\"Факт: first reconciliation wrote STATUS=ERROR because router-running-config-mail-cloud.txt is on pve01, not edge-vm.\"},{\"line\":214,\"text\":\"- Context: attempted Netcraze router ACL apply through SSH stdin/multiline for Homepage Moscow Router monitor fix.\"},{\"line\":217,\"text\":\"- Rule: do not apply Netcraze config through stdin/multiline SSH; prove CLI input mode first.\"},{\"line\":224,\"text\":\"## ROUTERBACKUP_READONLY_CLI_PERMISSION_LIMIT_20260630\"},{\"line\":225,\"text\":\"- Context: routerbackup user can run show running-config but cannot execute configuration commands such as access-list.\"},{\"line\":228,\"text\":\"- Rule: do not attempt ACL/config changes as routerbackup; use admin/operator router access or router Web UI for write changes.\"},{\"line\":239,\"text\":\"- Rule: after manual router Web UI ACL edits, compare _WEBADMIN_Bridge0, _WEBADMIN_Bridge1 and _WEBADMIN_GigabitEthernet1 before continuing.\"},{\"line\":250,\"text\":\"- Observed: edge-vm TCP to [PRIVATE_IP]:5080/5083 is OK, but router HTTP/HTTPS returns 403 for all tested paths.\"},{\"line\":265,\"text\":\"- Mitigation: use dedicated edge-vm health endpoint that checks router TCP [PRIVATE_IP]:5080 and returns HTTP 200/503 for Homepage.\"},{\"line\":598,\"text\":\"- Context: taftauto.ru points to the dacha router public IP. Operator confirmed the router model is Netcraze-like, same family as Moscow router.\"},{\"line\":604,\"text\":\"- Context: taftauto.ru points to the dacha router public IP. Operator confirmed the router model is Netcraze-like, same family as Moscow router.\"},{\"line\":612,\"text\":\"- Rule: generated client config may be stored only as root/debian mode 600 file and must be imported into the Netcraze router UI manually.\"},{\"line\":3180,\"text\":\"TAFTAUTO_INTERMITTENT_HTTP_TIMEOUT_20260904 | CLOSED_BLOCKED_REMOTE_SERVICE | VM130 route via wg-taftauto is healthy, WireGuard handshake is current, ICMP to [PRIVATE_IP] succeeds, but remote TCP/80 and TCP/443 are not listening. NPMplus/EDGE path is not the root cause; remediation requires the remote dacha service/router side.\"}]\nNEWFI43_REFERENCE_ROUTER_CLUE_COUNT=24\nNEWFI43_REFERENCE_ROUTER_CLUES=[{\"line\":199,\"text\":\"## ROUTER_NETCRAZE_ULTRA_NC1812_20260630\"},{\"line\":201,\"text\":\"Источник: self-test Netcraze Ultra NC-1812 от 2026-06-30. Секреты Wi-Fi, пароли и токены в справочник не вносятся.\"},{\"line\":204,\"text\":\"- Model: Netcraze Ultra.\"},{\"line\":205,\"text\":\"- Device description: Netcraze Ultra (NC-1812).\"},{\"line\":206,\"text\":\"- Hostname: Netcraze-9202.\"},{\"line\":211,\"text\":\"- Локальный домен/сертификат в логах: aleisaevn.netcraze.pro.\"},{\"line\":317,\"text\":\"- ISP tcp/443 -> bc:24:11:e1:f3:3c, NPMplus.\"},{\"line\":355,\"text\":\"- Netcraze SSH CLI is not a normal POSIX shell.\"},{\"line\":683,\"text\":\"- Public WAN router forwards TCP/80 and TCP/443 to NPMplus on edge-vm, [PRIVATE_IP].\"},{\"line\":694,\"text\":\"- Public listen ports on edge-vm: [PRIVATE_IP]:80 and [PRIVATE_IP]:443 by nginx/NPMplus.\"},{\"line\":1237,\"text\":\"- edge-vm exposes public :80/:443 through NPMplus.\"},{\"line\":1356,\"text\":\"- Public ingress HTTP/HTTPS: router forwards TCP 80/443 to edge-vm [PRIVATE_IP].\"},{\"line\":1367,\"text\":\"| gotify.gram1.ru | http://[PRIVATE_IP]:8082 | edge-vm / gotify | gotify health, alert-routing proof |\"},{\"line\":1368,\"text\":\"| vault.gram1.ru | http://[PRIVATE_IP]:8083 | edge-vm / vaultwarden | vaultwarden backup/offhost/restore |\"},{\"line\":1373,\"text\":\"| paper.gram1.ru | http://[PRIVATE_IP]:8010 | edge-vm / paperless | paperless backup/offhost/restore |\"},{\"line\":1626,\"text\":\"- Do not run bash/POSIX automation against Netcraze CLI; use router CLI syntax only.\"},{\"line\":1660,\"text\":\"- Timer: homelab-router-running-config-mail-cloud.timer.\"},{\"line\":1661,\"text\":\"- Health file: /var/lib/homelab-health/router-running-config-mail-cloud.txt.\"},{\"line\":1697,\"text\":\"- Router recurring backup uses a dedicated routerbackup credential file on pve01.\"},{\"line\":1698,\"text\":\"- Secret file path: /var/lib/homelab-private/secrets/routerbackup.pass.\"},{\"line\":2105,\"text\":\"- Netcraze routerbackup SSH access is read-only for backup: show running-config works, but ACL/config commands are denied.\"},{\"line\":2106,\"text\":\"- Homepage Moscow Router red-dot fix requires router ACL/Web UI/admin-level change, not routerbackup.\"},{\"line\":2498,\"text\":\"- Landing service on edge-vm: homelab-pvepro-landing-http.service on http://[PRIVATE_IP]:18089.\"},{\"line\":2511,\"text\":\"- Router model family: Netcraze-like, same as Moscow router family by operator statement.\"}]\nNEWFI43_TRUST_ROUTER_CLUE_COUNT=0\nNEWFI43_TRUST_ROUTER_CLUES=[]\nNEWFI43_EXPECTED_EDGE_ROUTER_TARGET_COUNT=1\nNEWFI43_EXPECTED_EDGE_ROUTER_TARGET_HASHES=[\"bc517b4af3298846906234d3d697d3820b0b652ade1880c937c9d71cd802c834\"]\nNEWFI43_ROUTER_SNAPSHOT_PRESENT=false\nNEWFI43_TEXT_FILES_SCANNED=265\nNEWFI43_ROUTERBACKUP_ENDPOINT_COUNT=0\nNEWFI43_ROUTERBACKUP_ENDPOINT_HASHES=[]\nNEWFI43_ROUTER_RELATED_FILE_COUNT=21\nNEWFI43_ROUTER_RELATED_FILES=[{\"path\":\"/etc/pve/HOMELAB_ASSISTANT_ERROR_REGISTER.md\",\"sha256\":\"3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0\",\"size\":302058},{\"path\":\"/etc/pve/31_HOMELAB_REFERENCE.md\",\"sha256\":\"5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d66\",\"size\":201129},{\"path\":\"/srv/homelab-ops/tasks/snikket-edge-cutover-v1/task.json\",\"sha256\":\"9cad3f6291663d6e85a556882c8ed751eaaa61b816b9bae934032fb0677267fd\",\"size\":5697},{\"path\":\"/srv/homelab-ops/tasks/snikket-edge-cutover-v1/README.txt\",\"sha256\":\"f01ab83f721cd4782e60ebc57316dcc753caf96e03598ce57ba829d47a8daeec\",\"size\":734},{\"path\":\"/srv/homelab-ops/tasks/snikket-edge-cutover-v1/assets/edge01-home-restricted-ingress.nft\",\"sha256\":\"124cf4df2391ce0256eceaf7a1470c8f53588c467de06af8a317bcc2ffdacfba\",\"size\":1460},{\"path\":\"/srv/homelab-ops/tasks/snikket-edge-cutover-v1/assets/edge01-public-ingress.nft\",\"sha256\":\"a195c34384dd7b2cdbdd83472bf5d527c3ba7b1c80d97a23562ddb703b1b7220\",\"size\":1281},{\"path\":\"/srv/homelab-ops/tasks/snikket-edge-cutover-v1/tools/cutover.py\",\"sha256\":\"0b17af22f494cd5e299fceae33c9bff114cefd5ab886426f0b822794a6787287\",\"size\":16029},{\"path\":\"/srv/homelab-ops/tasks/snikket-home-forward-retire-v1/task.json\",\"sha256\":\"26b81f4a16e66e5e1f6b09d6d600c17a86a87d6bf1eaddd506bb33555480c8a3\",\"size\":5352},{\"path\":\"/srv/homelab-ops/tasks/snikket-home-forward-retire-v1/tools/retire_home_forwards.py\",\"sha256\":\"e63317e9f5ed00b4535ccbd0930b305fdf847a44c5a67a9cc0e94c05106ff2f8\",\"size\":17076},{\"path\":\"/srv/homelab-ops/tasks/snikket-turn-legacy-dns-retire-v1/task.json\",\"sha256\":\"48564bec1e1dc49ba117ea2590f7922030462a0f4f71a62adf19a033ddaf74b4\",\"size\":5427},{\"path\":\"/srv/homelab-ops/tasks/snikket-turn-legacy-dns-retire-v1/tools/retire_turn_dns.py\",\"sha256\":\"33328864f5677f7a2962fccd1707e32e429a4d818fb45c7395efc1a67d829a27\",\"size\":13921},{\"path\":\"/srv/homelab-ops/docs/superpowers/specs/2026-08-17-snikket-post-cutover-hardening-design.md\",\"sha256\":\"da27ba7192019193cb08c6fead1e0fc847671121bea63735492e8123468b1837\",\"size\":3702},{\"path\":\"/srv/homelab-ops/docs/superpowers/specs/2026-08-17-snikket-edge-cutover-design.md\",\"sha256\":\"b774fe2d10c15832030192e475ba707fbe6e7d286fd079c4ffcaec013424bc6c\",\"size\":3638},{\"path\":\"/srv/homelab-ops/docs/superpowers/plans/2026-08-18-gitea-edge-publisher-v3.md\",\"sha256\":\"f42b0e0be98c7f6d9f0e06d5565ec1cfc277e4221cbc164f21c157fe4121ad72\",\"size\":31037},{\"path\":\"/srv/homelab-ops/docs/superpowers/plans/2026-08-17-snikket-home-forward-retirement.md\",\"sha256\":\"415c7f8302baf917e954118551ddcb507f8359418846bf4aa429c173b856f9a6\",\"size\":3408},{\"path\":\"/srv/homelab-ops/docs/superpowers/plans/2026-08-17-snikket-edge-cutover.md\",\"sha256\":\"db6119a6a40c326609f1041239ce465d6a3f1d8f169512296db7de5ae4316a74\",\"size\":4548},{\"path\":\"/srv/homelab-ops/docs/superpowers/plans/2026-08-17-snikket-turn-legacy-dns-retirement.md\",\"sha256\":\"a5b937405e9e073a31d11786f2300ed6acc9d8aeed4579c7bc19ec44ec83b907\",\"size\":5118},{\"path\":\"/srv/homelab-ops/kb/AI_CONTEXT.md\",\"sha256\":\"5fc43e34a1f0714ddacf7c00ed5c4bbaf788df3b8407dcfebd1333a23a623acc\",\"size\":3587},{\"path\":\"/srv/homelab-ops/kb/runbooks/03_EDGE_NGINX.md\",\"sha256\":\"ed07c49d6d425bed81b09004b7fec2844f38be270919bc04cb65c6b534a2b02b\",\"size\":650},{\"path\":\"/srv/homelab-ops/tests/test_cr_2026_0080_snikket_edge_cutover.py\",\"sha256\":\"a8b58624a22ea817b2696b50b3d410fb4cd23dd013f865d7d80ce465ebe8cf57\",\"size\":6137},{\"path\":\"/srv/homelab-ops/tests/test_cr_2026_0081_home_forward_retire.py\",\"sha256\":\"317aa49a5c23f395ca006b9e63cb26c298cb060e37e2cc26e9cd6783d777a468\",\"size\":6119}]\nNEWFI43_ROUTER_SCRIPT_CANDIDATES=[{\"path\":\"/srv/homelab-ops/tasks/snikket-home-forward-retire-v1/task.json\",\"sha256\":\"26b81f4a16e66e5e1f6b09d6d600c17a86a87d6bf1eaddd506bb33555480c8a3\",\"mode\":\"0o644\"},{\"path\":\"/srv/homelab-ops/tasks/snikket-home-forward-retire-v1/tools/retire_home_forwards.py\",\"sha256\":\"e63317e9f5ed00b4535ccbd0930b305fdf847a44c5a67a9cc0e94c05106ff2f8\",\"mode\":\"0o755\"}]\nNEWFI43_ROUTERBACKUP_READ_CAPABILITY_ASSERTED=true\nNEWFI43_ROUTERBACKUP_WRITE_DENIED_ASSERTED=true\nNEWFI43_ROUTER_WRITER_REFERENCE_PRESENT=true\nNEWFI43_ROUTER_EXISTING_KNOWN_HOST_MATCH_COUNT=0\nNEWFI43_ROUTER_LIVE_SHOW_RUNNING_CONFIG_RC=NOT_ATTEMPTED\nNEWFI43_SNAPSHOT_TARGET_RELATION=UNKNOWN\nNEWFI43_LIVE_TARGET_RELATION=UNKNOWN\nNEWFI43_DECISION=HOLD_ROUTERBACKUP_ENDPOINT_NOT_UNIQUE_REVIEW_EXACT_REFERENCES\nNEWFI43_KNOWN_HOSTS_SHA256_AFTER=ab01de61ca5030ad158f1aef377364100531473de1e10a529089174f6890d735\nNEWFI43_KNOWN_HOSTS_UNCHANGED=true\nNEWFI43_CHANGES_MADE=false\nNEWFI43_MUTATION_SCOPE=NONE_READ_ONLY\nNEWFI43_RCA_EXECUTION=PASS\n" +} diff --git a/runtime/history/NEWFI-260908-A-STAGINGEDGE-PUBLICINGRESS-WRITERPATH-RCA43.txt b/runtime/history/NEWFI-260908-A-STAGINGEDGE-PUBLICINGRESS-WRITERPATH-RCA43.txt new file mode 100644 index 00000000..8a0451e1 --- /dev/null +++ b/runtime/history/NEWFI-260908-A-STAGINGEDGE-PUBLICINGRESS-WRITERPATH-RCA43.txt @@ -0,0 +1,65 @@ +CHAT_OUTPUT_BEGIN +COMMAND_ID=NEWFI-260908-A-STAGINGEDGE-PUBLICINGRESS-WRITERPATH-RCA43 +STATUS=OK +RC=0 +HOST=pve01 +MODE=read-only +COMPONENT=newfi-stagingedge-public-ingress-router-live-writerpath-rca-v7 +REFERENCE_REGISTER_CHECK=OK +REFERENCE_SHA256=5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d66 +ERROR_REGISTER_CHECK=OK +ERROR_REGISTER_SHA256=3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0 +COMMAND_SHA256=5d37f67460c7ccdd0ae041b342d7b75e929bf60333a13dd1b206e2befe296a6f +DUPLICATE_FAILED_COMMAND_BLOCKED=false +EXECUTION_STARTED=true +CHANGE_DECLARED=false +RESULT_CONTRACT_VALID=true +RESULT_CONTRACT_STATUS=NOT_APPLICABLE +RESULT_CONTRACT_ERROR=NONE +COMMAND_RC=0 +CHANGES_MADE=false +ROLLBACK_STARTED=false +ROLLBACK_RESTORED=null +MUTATION_OUTCOME=NO_MUTATION +SANITIZED=yes +SECRETS_INCLUDED=no +PRIVATE_ADDRESSES_INCLUDED=no +RAW_EVIDENCE_SHA256=a94b0dc6cf0dca478f6e33ea44afab6abb54befb21a9f4e5a10e819be229e2ad +SANITIZED_OUTPUT_SHA256=a94b0dc6cf0dca478f6e33ea44afab6abb54befb21a9f4e5a10e819be229e2ad +OUTPUT_BEGIN +ERROR_REGISTER_CHECK=OK +REFERENCE_CHECK=OK +AUTHORITY_CHECK_SCOPE=READABILITY_ONLY_INCIDENTS_NOT_CLOSED +NEWFI43_RUNNER_SHA256=b248a4c32c9cc64e5747e7dce6c7fc0a23f5124a77c71ce72e27a81aceae9d2d +NEWFI43_KNOWN_HOSTS_SHA256_BEFORE=ab01de61ca5030ad158f1aef377364100531473de1e10a529089174f6890d735 +NEWFI43_ERROR_ROUTER_CLUE_COUNT=13 +NEWFI43_ERROR_ROUTER_CLUES=[{"line":171,"text":"Факт: first reconciliation wrote STATUS=ERROR because router-running-config-mail-cloud.txt is on pve01, not edge-vm."},{"line":214,"text":"- Context: attempted Netcraze router ACL apply through SSH stdin/multiline for Homepage Moscow Router monitor fix."},{"line":217,"text":"- Rule: do not apply Netcraze config through stdin/multiline SSH; prove CLI input mode first."},{"line":224,"text":"## ROUTERBACKUP_READONLY_CLI_PERMISSION_LIMIT_20260630"},{"line":225,"text":"- Context: routerbackup user can run show running-config but cannot execute configuration commands such as access-list."},{"line":228,"text":"- Rule: do not attempt ACL/config changes as routerbackup; use admin/operator router access or router Web UI for write changes."},{"line":239,"text":"- Rule: after manual router Web UI ACL edits, compare _WEBADMIN_Bridge0, _WEBADMIN_Bridge1 and _WEBADMIN_GigabitEthernet1 before continuing."},{"line":250,"text":"- Observed: edge-vm TCP to [PRIVATE_IP]:5080/5083 is OK, but router HTTP/HTTPS returns 403 for all tested paths."},{"line":265,"text":"- Mitigation: use dedicated edge-vm health endpoint that checks router TCP [PRIVATE_IP]:5080 and returns HTTP 200/503 for Homepage."},{"line":598,"text":"- Context: taftauto.ru points to the dacha router public IP. Operator confirmed the router model is Netcraze-like, same family as Moscow router."},{"line":604,"text":"- Context: taftauto.ru points to the dacha router public IP. Operator confirmed the router model is Netcraze-like, same family as Moscow router."},{"line":612,"text":"- Rule: generated client config may be stored only as root/debian mode 600 file and must be imported into the Netcraze router UI manually."},{"line":3180,"text":"TAFTAUTO_INTERMITTENT_HTTP_TIMEOUT_20260904 | CLOSED_BLOCKED_REMOTE_SERVICE | VM130 route via wg-taftauto is healthy, WireGuard handshake is current, ICMP to [PRIVATE_IP] succeeds, but remote TCP/80 and TCP/443 are not listening. NPMplus/EDGE path is not the root cause; remediation requires the remote dacha service/router side."}] +NEWFI43_REFERENCE_ROUTER_CLUE_COUNT=24 +NEWFI43_REFERENCE_ROUTER_CLUES=[{"line":199,"text":"## ROUTER_NETCRAZE_ULTRA_NC1812_20260630"},{"line":201,"text":"Источник: self-test Netcraze Ultra NC-1812 от 2026-06-30. Секреты Wi-Fi, пароли и токены в справочник не вносятся."},{"line":204,"text":"- Model: Netcraze Ultra."},{"line":205,"text":"- Device description: Netcraze Ultra (NC-1812)."},{"line":206,"text":"- Hostname: Netcraze-9202."},{"line":211,"text":"- Локальный домен/сертификат в логах: aleisaevn.netcraze.pro."},{"line":317,"text":"- ISP tcp/443 -> bc:24:11:e1:f3:3c, NPMplus."},{"line":355,"text":"- Netcraze SSH CLI is not a normal POSIX shell."},{"line":683,"text":"- Public WAN router forwards TCP/80 and TCP/443 to NPMplus on edge-vm, [PRIVATE_IP]."},{"line":694,"text":"- Public listen ports on edge-vm: [PRIVATE_IP]:80 and [PRIVATE_IP]:443 by nginx/NPMplus."},{"line":1237,"text":"- edge-vm exposes public :80/:443 through NPMplus."},{"line":1356,"text":"- Public ingress HTTP/HTTPS: router forwards TCP 80/443 to edge-vm [PRIVATE_IP]."},{"line":1367,"text":"| gotify.gram1.ru | http://[PRIVATE_IP]:8082 | edge-vm / gotify | gotify health, alert-routing proof |"},{"line":1368,"text":"| vault.gram1.ru | http://[PRIVATE_IP]:8083 | edge-vm / vaultwarden | vaultwarden backup/offhost/restore |"},{"line":1373,"text":"| paper.gram1.ru | http://[PRIVATE_IP]:8010 | edge-vm / paperless | paperless backup/offhost/restore |"},{"line":1626,"text":"- Do not run bash/POSIX automation against Netcraze CLI; use router CLI syntax only."},{"line":1660,"text":"- Timer: homelab-router-running-config-mail-cloud.timer."},{"line":1661,"text":"- Health file: /var/lib/homelab-health/router-running-config-mail-cloud.txt."},{"line":1697,"text":"- Router recurring backup uses a dedicated routerbackup credential file on pve01."},{"line":1698,"text":"- Secret file path: /var/lib/homelab-private/secrets/routerbackup.pass."},{"line":2105,"text":"- Netcraze routerbackup SSH access is read-only for backup: show running-config works, but ACL/config commands are denied."},{"line":2106,"text":"- Homepage Moscow Router red-dot fix requires router ACL/Web UI/admin-level change, not routerbackup."},{"line":2498,"text":"- Landing service on edge-vm: homelab-pvepro-landing-http.service on http://[PRIVATE_IP]:18089."},{"line":2511,"text":"- Router model family: Netcraze-like, same as Moscow router family by operator statement."}] +NEWFI43_TRUST_ROUTER_CLUE_COUNT=0 +NEWFI43_TRUST_ROUTER_CLUES=[] +NEWFI43_EXPECTED_EDGE_ROUTER_TARGET_COUNT=1 +NEWFI43_EXPECTED_EDGE_ROUTER_TARGET_HASHES=["bc517b4af3298846906234d3d697d3820b0b652ade1880c937c9d71cd802c834"] +NEWFI43_ROUTER_SNAPSHOT_PRESENT=false +NEWFI43_TEXT_FILES_SCANNED=265 +NEWFI43_ROUTERBACKUP_ENDPOINT_COUNT=0 +NEWFI43_ROUTERBACKUP_ENDPOINT_HASHES=[] +NEWFI43_ROUTER_RELATED_FILE_COUNT=21 +NEWFI43_ROUTER_RELATED_FILES=[{"path":"/etc/pve/HOMELAB_ASSISTANT_ERROR_REGISTER.md","sha256":"3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0","size":302058},{"path":"/etc/pve/31_HOMELAB_REFERENCE.md","sha256":"5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d66","size":201129},{"path":"/srv/homelab-ops/tasks/snikket-edge-cutover-v1/task.json","sha256":"9cad3f6291663d6e85a556882c8ed751eaaa61b816b9bae934032fb0677267fd","size":5697},{"path":"/srv/homelab-ops/tasks/snikket-edge-cutover-v1/README.txt","sha256":"f01ab83f721cd4782e60ebc57316dcc753caf96e03598ce57ba829d47a8daeec","size":734},{"path":"/srv/homelab-ops/tasks/snikket-edge-cutover-v1/assets/edge01-home-restricted-ingress.nft","sha256":"124cf4df2391ce0256eceaf7a1470c8f53588c467de06af8a317bcc2ffdacfba","size":1460},{"path":"/srv/homelab-ops/tasks/snikket-edge-cutover-v1/assets/edge01-public-ingress.nft","sha256":"a195c34384dd7b2cdbdd83472bf5d527c3ba7b1c80d97a23562ddb703b1b7220","size":1281},{"path":"/srv/homelab-ops/tasks/snikket-edge-cutover-v1/tools/cutover.py","sha256":"0b17af22f494cd5e299fceae33c9bff114cefd5ab886426f0b822794a6787287","size":16029},{"path":"/srv/homelab-ops/tasks/snikket-home-forward-retire-v1/task.json","sha256":"26b81f4a16e66e5e1f6b09d6d600c17a86a87d6bf1eaddd506bb33555480c8a3","size":5352},{"path":"/srv/homelab-ops/tasks/snikket-home-forward-retire-v1/tools/retire_home_forwards.py","sha256":"e63317e9f5ed00b4535ccbd0930b305fdf847a44c5a67a9cc0e94c05106ff2f8","size":17076},{"path":"/srv/homelab-ops/tasks/snikket-turn-legacy-dns-retire-v1/task.json","sha256":"48564bec1e1dc49ba117ea2590f7922030462a0f4f71a62adf19a033ddaf74b4","size":5427},{"path":"/srv/homelab-ops/tasks/snikket-turn-legacy-dns-retire-v1/tools/retire_turn_dns.py","sha256":"33328864f5677f7a2962fccd1707e32e429a4d818fb45c7395efc1a67d829a27","size":13921},{"path":"/srv/homelab-ops/docs/superpowers/specs/2026-08-17-snikket-post-cutover-hardening-design.md","sha256":"da27ba7192019193cb08c6fead1e0fc847671121bea63735492e8123468b1837","size":3702},{"path":"/srv/homelab-ops/docs/superpowers/specs/2026-08-17-snikket-edge-cutover-design.md","sha256":"b774fe2d10c15832030192e475ba707fbe6e7d286fd079c4ffcaec013424bc6c","size":3638},{"path":"/srv/homelab-ops/docs/superpowers/plans/2026-08-18-gitea-edge-publisher-v3.md","sha256":"f42b0e0be98c7f6d9f0e06d5565ec1cfc277e4221cbc164f21c157fe4121ad72","size":31037},{"path":"/srv/homelab-ops/docs/superpowers/plans/2026-08-17-snikket-home-forward-retirement.md","sha256":"415c7f8302baf917e954118551ddcb507f8359418846bf4aa429c173b856f9a6","size":3408},{"path":"/srv/homelab-ops/docs/superpowers/plans/2026-08-17-snikket-edge-cutover.md","sha256":"db6119a6a40c326609f1041239ce465d6a3f1d8f169512296db7de5ae4316a74","size":4548},{"path":"/srv/homelab-ops/docs/superpowers/plans/2026-08-17-snikket-turn-legacy-dns-retirement.md","sha256":"a5b937405e9e073a31d11786f2300ed6acc9d8aeed4579c7bc19ec44ec83b907","size":5118},{"path":"/srv/homelab-ops/kb/AI_CONTEXT.md","sha256":"5fc43e34a1f0714ddacf7c00ed5c4bbaf788df3b8407dcfebd1333a23a623acc","size":3587},{"path":"/srv/homelab-ops/kb/runbooks/03_EDGE_NGINX.md","sha256":"ed07c49d6d425bed81b09004b7fec2844f38be270919bc04cb65c6b534a2b02b","size":650},{"path":"/srv/homelab-ops/tests/test_cr_2026_0080_snikket_edge_cutover.py","sha256":"a8b58624a22ea817b2696b50b3d410fb4cd23dd013f865d7d80ce465ebe8cf57","size":6137},{"path":"/srv/homelab-ops/tests/test_cr_2026_0081_home_forward_retire.py","sha256":"317aa49a5c23f395ca006b9e63cb26c298cb060e37e2cc26e9cd6783d777a468","size":6119}] +NEWFI43_ROUTER_SCRIPT_CANDIDATES=[{"path":"/srv/homelab-ops/tasks/snikket-home-forward-retire-v1/task.json","sha256":"26b81f4a16e66e5e1f6b09d6d600c17a86a87d6bf1eaddd506bb33555480c8a3","mode":"0o644"},{"path":"/srv/homelab-ops/tasks/snikket-home-forward-retire-v1/tools/retire_home_forwards.py","sha256":"e63317e9f5ed00b4535ccbd0930b305fdf847a44c5a67a9cc0e94c05106ff2f8","mode":"0o755"}] +NEWFI43_ROUTERBACKUP_READ_CAPABILITY_ASSERTED=true +NEWFI43_ROUTERBACKUP_WRITE_DENIED_ASSERTED=true +NEWFI43_ROUTER_WRITER_REFERENCE_PRESENT=true +NEWFI43_ROUTER_EXISTING_KNOWN_HOST_MATCH_COUNT=0 +NEWFI43_ROUTER_LIVE_SHOW_RUNNING_CONFIG_RC=NOT_ATTEMPTED +NEWFI43_SNAPSHOT_TARGET_RELATION=UNKNOWN +NEWFI43_LIVE_TARGET_RELATION=UNKNOWN +NEWFI43_DECISION=HOLD_ROUTERBACKUP_ENDPOINT_NOT_UNIQUE_REVIEW_EXACT_REFERENCES +NEWFI43_KNOWN_HOSTS_SHA256_AFTER=ab01de61ca5030ad158f1aef377364100531473de1e10a529089174f6890d735 +NEWFI43_KNOWN_HOSTS_UNCHANGED=true +NEWFI43_CHANGES_MADE=false +NEWFI43_MUTATION_SCOPE=NONE_READ_ONLY +NEWFI43_RCA_EXECUTION=PASS + +OUTPUT_END +CHAT_OUTPUT_END diff --git a/runtime/latest.json b/runtime/latest.json index 2568b9d3..778baa18 100644 --- a/runtime/latest.json +++ b/runtime/latest.json @@ -1,19 +1,19 @@ { "schema_version": 1, "channel": "homelab-runtime", - "command_id": "NEWFI-260908-A-STAGINGEDGE-PUBLICINGRESS-TOPOLOGY-RCA42", + "command_id": "NEWFI-260908-A-STAGINGEDGE-PUBLICINGRESS-WRITERPATH-RCA43", "status": "OK", "rc": 0, "host": "pve01", "mode": "read-only", - "component": "newfi-stagingedge-public-ingress-topology-rca-v6", - "started_at_utc": "2026-09-08T18:19:52Z", - "finished_at_utc": "2026-09-08T18:19:52Z", + "component": "newfi-stagingedge-public-ingress-router-live-writerpath-rca-v7", + "started_at_utc": "2026-09-08T18:29:28Z", + "finished_at_utc": "2026-09-08T18:29:28Z", "reference_register_checked": true, "reference_sha256": "5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d66", "error_register_checked": true, "error_register_sha256": "3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0", - "command_sha256": "8c1deae24d2c2e50bd7eca16ab18b10c78eb623b43884a033be8abcb060328de", + "command_sha256": "5d37f67460c7ccdd0ae041b342d7b75e929bf60333a13dd1b206e2befe296a6f", "duplicate_failed_command_blocked": false, "block_reason": null, "execution_started": true, @@ -30,9 +30,9 @@ "secrets_included": false, "private_addresses_included": false, "raw_evidence_retained_locally": true, - "raw_evidence_sha256": "475297be47aae03d0ef913ed8d3c90d3f0eabe4b0a86b02e6cccd5e805171e4f", - "sanitized_output_sha256": "2740dbcc0eb7d919991be01db110d70f85f1c7ab59bcebf520b56960fa9399f9", + "raw_evidence_sha256": "a94b0dc6cf0dca478f6e33ea44afab6abb54befb21a9f4e5a10e819be229e2ad", + "sanitized_output_sha256": "a94b0dc6cf0dca478f6e33ea44afab6abb54befb21a9f4e5a10e819be229e2ad", "output_truncated_in_json": false, "full_sanitized_output_url": "https://git.gram1.ru/.well-known/homelab-runtime/latest.txt", - "output": "ERROR_REGISTER_CHECK=OK\nREFERENCE_CHECK=OK\nAUTHORITY_CHECK_SCOPE=READABILITY_ONLY_INCIDENTS_NOT_CLOSED\nNEWFI42_RUNNER_SHA256=b248a4c32c9cc64e5747e7dce6c7fc0a23f5124a77c71ce72e27a81aceae9d2d\nNEWFI42_KNOWN_HOSTS_SHA256_BEFORE=ab01de61ca5030ad158f1aef377364100531473de1e10a529089174f6890d735\nNEWFI42_TRUST_FILE_PRESENT=true\nNEWFI42_TRUST_FILE_SHA256=5ff80132df401240519f48091ed62c139183c325000ef7dd253e7f676a539b2c\nNEWFI42_TRUST_EDGEVM_MARKER=true\nNEWFI42_TRUST_REJECTED_MARKER=false\nNEWFI42_ERROR_RELEVANT_LINE_COUNT=50\nNEWFI42_ERROR_RELEVANT_LINES=[{\"line\":19,\"text\":\"CHECK-8: для edge-vm использовать debian@[PRIVATE_IP] и sudo.\"},{\"line\":28,\"text\":\"VM130 edge-vm has secondary disk backup=0 risk.\"},{\"line\":52,\"text\":\"edge-vm: ssh debian@[PRIVATE_IP], внутри использовать sudo.\"},{\"line\":170,\"text\":\"41. Ошибка: post-backup-pass-slo-reconciliation checked pve01 router health on edge-vm.\"},{\"line\":171,\"text\":\"Факт: first reconciliation wrote STATUS=ERROR because router-running-config-mail-cloud.txt is on pve01, not edge-vm.\"},{\"line\":172,\"text\":\"Fix: build reconciliation from pve01 and edge-vm health files by correct owner.\"},{\"line\":213,\"text\":\"## ROUTER_CLI_STDIN_APPLY_FAILURE_20260630\"},{\"line\":214,\"text\":\"- Context: attempted Netcraze router ACL apply through SSH stdin/multiline for Homepage Moscow Router monitor fix.\"},{\"line\":215,\"text\":\"- Evidence: [LONG_REDACTED].txt.\"},{\"line\":219,\"text\":\"## [LONG_REDACTED]\"},{\"line\":221,\"text\":\"- Evidence: [LONG_REDACTED].txt showed COMMAND_COUNT=1.\"},{\"line\":224,\"text\":\"## [LONG_REDACTED]\"},{\"line\":225,\"text\":\"- Context: routerbackup user can run show running-config but cannot execute configuration commands such as access-list.\"},{\"line\":226,\"text\":\"- Evidence: [LONG_REDACTED].txt.\"},{\"line\":228,\"text\":\"- Rule: do not attempt ACL/config changes as routerbackup; use admin/operator router access or router Web UI for write changes.\"},{\"line\":232,\"text\":\"- Evidence: [LONG_REDACTED].txt has blank [LONG_REDACTED] fields.\"},{\"line\":235,\"text\":\"## [LONG_REDACTED]\"},{\"line\":236,\"text\":\"- Context: while moving Moscow Router monitor rules to _WEBADMIN_Bridge1, two _WEBADMIN_Bridge0 Nextcloud Talk TURN rules were accidentally removed.\"},{\"line\":238,\"text\":\"- Verification proof: 399_ROUTER_ACL_RESTORE_AFTER_UI_PROOF.txt.\"},{\"line\":239,\"text\":\"- Rule: after manual router Web UI ACL edits, compare _WEBADMIN_Bridge0, _WEBADMIN_Bridge1 and _WEBADMIN_GigabitEthernet1 before continuing.\"},{\"line\":241,\"text\":\"## [LONG_REDACTED]\"},{\"line\":242,\"text\":\"- Context: proof 400 tested Moscow router HTTPS monitor from Homepage container with custom Node lookup callback.\"},{\"line\":247,\"text\":\"## [LONG_REDACTED]\"},{\"line\":248,\"text\":\"- Context: Moscow Router Homepage monitor after ACL fix.\"},{\"line\":250,\"text\":\"- Observed: edge-vm TCP to [PRIVATE_IP]:5080/5083 is OK, but router HTTP/HTTPS returns 403 for all tested paths.\"},{\"line\":251,\"text\":\"- Impact: Homepage siteMonitor cannot be made green via direct router HTTP URL until router web service allows the Bridge1/Proxmox/protected segment or an explicit safe monitor endpoint is used.\"},{\"line\":255,\"text\":\"- Context: installing edge-vm Moscow router health endpoint.\"},{\"line\":261,\"text\":\"## [LONG_REDACTED]\"},{\"line\":262,\"text\":\"- Context: Moscow Router Homepage siteMonitor attempt using http://[PRIVATE_IP]:5080.\"},{\"line\":264,\"text\":\"- Impact: do not use [PRIVATE_IP] directly as Homepage siteMonitor from edge-vm.\"},{\"line\":265,\"text\":\"- Mitigation: use dedicated edge-vm health endpoint that checks router TCP [PRIVATE_IP]:5080 and returns HTTP 200/503 for Homepage.\"},{\"line\":267,\"text\":\"## [LONG_REDACTED]\"},{\"line\":268,\"text\":\"- Context: applying Moscow Router Homepage siteMonitor health endpoint.\"},{\"line\":273,\"text\":\"## [LONG_REDACTED]\"},{\"line\":274,\"text\":\"- Context: applying Moscow Router Homepage health endpoint.\"},{\"line\":276,\"text\":\"- Evidence: proof 408 showed SyntaxError in /tmp/homepage-router-moscow-apply-fixed.py.\"},{\"line\":582,\"text\":\"- Context: pvepro.ru root/www currently point to the Mailcow VPS and return Mailcow with TLS hostname mismatch.\"},{\"line\":583,\"text\":\"- Decision: because pve01 has no SSH key access to the external VPS, do not modify the VPS. Instead move only pvepro.ru and www.pvepro.ru A records to edge and serve an edge landing page.\"},{\"line\":598,\"text\":\"- Context: taftauto.ru points to the dacha router public IP. Operator confirmed the router model is Netcraze-like, same family as Moscow router.\"},{\"line\":599,\"text\":\"- Current limitation: there is no safe private remote access path to the dacha router yet.\"},{\"line\":600,\"text\":\"- Rule: do not expose router admin publicly and do not attempt certificate deployment to the router over the public internet.\"},{\"line\":604,\"text\":\"- Context: taftauto.ru points to the dacha router public IP. Operator confirmed the router model is Netcraze-like, same family as Moscow router.\"},{\"line\":605,\"text\":\"- Current limitation: there is no safe private remote access path to the dacha router yet.\"},{\"line\":606,\"text\":\"- Rule: do not expose router admin publicly and do not attempt certificate deployment to the router over the public internet.\"},{\"line\":610,\"text\":\"- Context: configuring private management path for taftauto.ru dacha router.\"},{\"line\":612,\"text\":\"- Rule: generated client config may be stored only as root/debian mode 600 file and must be imported into the Netcraze router UI manually.\"},{\"line\":613,\"text\":\"- Rule: do not open router public admin or certificate deployment until WireGuard handshake is proven.\"},{\"line\":626,\"text\":\"- Fix: rebuild SmartApe under External Homelabs with 2-space item indentation, remove Router Moscow, rebuild Sites category.\"},{\"line\":647,\"text\":\"## [LONG_REDACTED]\"},{\"line\":648,\"text\":\"- Previous apply looked for Russian Router card name, but active Homepage Useful group contains Router and Public Domain.\"}]\nNEWFI42_REFERENCE_RELEVANT_LINE_COUNT=50\nNEWFI42_REFERENCE_RELEVANT_LINES=[{\"line\":14,\"text\":\"- VM130 edge-vm | pve03 | running | KEEP\"},{\"line\":75,\"text\":\"NOTE edge-vm disk scsi1 backup=0 risk must be documented\"},{\"line\":90,\"text\":\"HEALTH_NOT_OK item=ingress-dns-route-slo.txt line=STATUS=WARN\"},{\"line\":149,\"text\":\"- У VM130 edge-vm есть риск: дополнительный диск backup=0.\"},{\"line\":166,\"text\":\"- VM130 edge-vm pve03 [PRIVATE_IP] Docker ingress/app host.\"},{\"line\":199,\"text\":\"## ROUTER_NETCRAZE_ULTRA_NC1812_20260630\"},{\"line\":234,\"text\":\"- WAN DHCP observed in router log: 95.84.154.183/23, gateway 95.84.154.1.\"},{\"line\":235,\"text\":\"- ISP DNS observed in router log: 77.37.251.33, 77.37.255.30.\"},{\"line\":282,\"text\":\"- Default router: [PRIVATE_IP].\"},{\"line\":312,\"text\":\"- [PRIVATE_IP] -> bc:24:11:e1:f3:3c NPMplus / edge-vm.\"},{\"line\":315,\"text\":\"### NAT / port forwarding\"},{\"line\":324,\"text\":\"- _WEBADMIN_GigabitEthernet1 permits admin PC [PRIVATE_IP] outbound TCP 80/443.\"},{\"line\":327,\"text\":\"### Router management\"},{\"line\":333,\"text\":\"- Telnet port configured: 2323, security-level private; router log shows Telnet disabled later on 2026-06-26.\"},{\"line\":339,\"text\":\"### Router services\"},{\"line\":354,\"text\":\"### Router automation warning\"},{\"line\":357,\"text\":\"- Automation must use router CLI syntax, not bash syntax.\"},{\"line\":366,\"text\":\"- edge-vm: no UPS/NUT/APCUPSD integration discovered.\"},{\"line\":371,\"text\":\"- NetBird service is active on pve01, pve02, pve03 and edge-vm.\"},{\"line\":376,\"text\":\"- edge-vm: FQDN edge-vm.netbird.selfhosted, IPv4 100.100.60.182/16.\"},{\"line\":395,\"text\":\"- edge-vm owns most application health, dashboard, ingress, backup, NetBox, NPMplus, certificate, Trivy and vulnerability jobs.\"},{\"line\":396,\"text\":\"- pve01 owns many [LONG_REDACTED] VPS/rclone/sops/scrutiny jobs.\"},{\"line\":455,\"text\":\"- edge-vm timers cover runtime dashboard, Paperless guard, external canary, health metrics, restore drill index, AdGuard rewrite sync, NPMplus cert expiry, NetBox backup/sync, retention, cluster daily status, vulnerability and Trivy scans, ingress hardening an\"},{\"line\":456,\"text\":\"- pve01 timers cover VPN/NetBird health, health metrics, smartctl, disk space, MkDocs refresh, VPS identity audit, storage capacity, quality gate, evidence catalog, backup freshness, docker health, Filebrowser backup/offhost/restore, NPMplus/Kuma backup, NetBi\"},{\"line\":459,\"text\":\"- Script hashes were captured for /usr/local/sbin and /usr/local/bin on edge-vm, pve01, pve02 and pve03.\"},{\"line\":531,\"text\":\"- Main active workload: VM130 edge-vm.\"},{\"line\":545,\"text\":\"- Network: vmbr0, gateway [PRIVATE_IP].\"},{\"line\":560,\"text\":\"- Network: vmbr0, gateway [PRIVATE_IP].\"},{\"line\":575,\"text\":\"- Network: vmbr0, gateway [PRIVATE_IP].\"},{\"line\":590,\"text\":\"- Network: vmbr0, gateway [PRIVATE_IP].\"},{\"line\":597,\"text\":\"### VM130 edge-vm\"},{\"line\":600,\"text\":\"- Name: edge-vm.\"},{\"line\":608,\"text\":\"- Network: vmbr0, gateway [PRIVATE_IP].\"},{\"line\":626,\"text\":\"- Network: vmbr0, gateway [PRIVATE_IP].\"},{\"line\":643,\"text\":\"- Network: vmbr0, gateway [PRIVATE_IP].\"},{\"line\":653,\"text\":\"## [LONG_REDACTED]\"},{\"line\":672,\"text\":\"- git.gram1.ru -> [PRIVATE_IP].\"},{\"line\":682,\"text\":\"### Router ingress\"},{\"line\":683,\"text\":\"- Public WAN router forwards TCP/80 and TCP/443 to NPMplus on edge-vm, [PRIVATE_IP].\"},{\"line\":684,\"text\":\"- Router forwards TCP/UDP 3478 to Nextcloud Talk TURN on [PRIVATE_IP].\"},{\"line\":685,\"text\":\"- Router forwards Home TCP/51820 to WireGuard host [PRIVATE_IP].\"},{\"line\":686,\"text\":\"- NPMplus admin listener is bound to localhost on edge-vm, [PRIVATE_IP]:81; public disabled legacy host npm.gram1.ru exists but enabled=0.\"},{\"line\":689,\"text\":\"- Host: edge-vm, [PRIVATE_IP].\"},{\"line\":694,\"text\":\"- Public listen ports on edge-vm: [PRIVATE_IP]:80 and [PRIVATE_IP]:443 by nginx/NPMplus.\"},{\"line\":705,\"text\":\"- git.gram1.ru -> http://[PRIVATE_IP]:3002, cert=29, ssl_forced=1, enabled=1.\"},{\"line\":754,\"text\":\"- cert=29: git.gram1.ru, expires 2026-09-13 17:36:55.\"},{\"line\":762,\"text\":\"- NPMplus schema/listen inventory: [LONG_REDACTED].txt.\"},{\"line\":769,\"text\":\"- Host: edge-vm, IP [PRIVATE_IP].\"},{\"line\":774,\"text\":\"- Public ingress terminates through NPMplus on ports 80/443.\"},{\"line\":826,\"text\":\"- Ingress/security: npmplus, socket-proxy, crowdsec.\"}]\nNEWFI42_TRUST_RELEVANT_LINE_COUNT=37\nNEWFI42_TRUST_RELEVANT_LINES=[{\"line\":1,\"text\":\"# NetBird VPS trust readiness\"},{\"line\":14,\"text\":\"public_ip=188.127.235.6\"},{\"line\":21,\"text\":\"netbird_vps_backup_ok=1\"},{\"line\":22,\"text\":\"netbird_vps_offhost_ok=1\"},{\"line\":23,\"text\":\"netbird_vps_restore_ok=1\"},{\"line\":27,\"text\":\"- Do not use public IP 188.127.235.6 until its host-key mismatch is intentionally resolved.\"},{\"line\":37,\"text\":\"--- HOST=188.127.235.6\"},{\"line\":39,\"text\":\"KNOWN_FP host=188.127.235.6 256 SHA256:[LONG_REDACTED] |1|/0oIfigkDxhJFJWj72WrkRkYUqo=|29qT4RhgqPPXt3sOwBqw7QrafBY= (ECDSA)\"},{\"line\":40,\"text\":\"KNOWN_FP host=188.127.235.6 3072 SHA256:[LONG_REDACTED] |1|Hmbhg2wXCUS/SDiuLTTgk6Vxhns=|kw5S70w76UhROmk1XT92s4Z757Y= (RSA)\"},{\"line\":41,\"text\":\"KNOWN_FP host=188.127.235.6 256 SHA256:[LONG_REDACTED] |1|q70vtOfl5nR+CvnLuV7OQ3aEFIo=|OJi44TxJaz3cfw57HO19UEkZc/M= (ED25519)\"},{\"line\":43,\"text\":\"KEYSCAN_FP host=188.127.235.6 256 SHA256:[LONG_REDACTED] 188.127.235.6 (ED25519)\"},{\"line\":44,\"text\":\"KEYSCAN_FP host=188.127.235.6 3072 SHA256:[LONG_REDACTED] 188.127.235.6 (RSA)\"},{\"line\":45,\"text\":\"KEYSCAN_FP host=188.127.235.6 256 SHA256:[LONG_REDACTED] 188.127.235.6 (ECDSA)\"},{\"line\":63,\"text\":\"REMOTE_HOSTNAME=edge-vm\"},{\"line\":71,\"text\":\"256 SHA256:[LONG_REDACTED] root@edge-vm (ED25519)\"},{\"line\":72,\"text\":\"256 SHA256:[LONG_REDACTED] root@edge-vm (ECDSA)\"},{\"line\":73,\"text\":\"3072 SHA256:[LONG_REDACTED] root@edge-vm (RSA)\"},{\"line\":77,\"text\":\"REMOTE_HOSTNAME=edge-vm\"},{\"line\":85,\"text\":\"256 SHA256:[LONG_REDACTED] root@edge-vm (ED25519)\"},{\"line\":86,\"text\":\"256 SHA256:[LONG_REDACTED] root@edge-vm (ECDSA)\"},{\"line\":87,\"text\":\"3072 SHA256:[LONG_REDACTED] root@edge-vm (RSA)\"},{\"line\":102,\"text\":\"PUBLIC_STRICT ssh-keygen -f '[SENSITIVE_PATH] -R '188.127.235.6'\"},{\"line\":103,\"text\":\"PUBLIC_STRICT Host key for 188.127.235.6 has changed and you have requested strict checking.\"},{\"line\":107,\"text\":\"--- [LONG_REDACTED].txt\"},{\"line\":108,\"text\":\"STATUS=OK TS=2026-07-07T15:15:14Z TYPE=external-probe-vps BAD=0 WARN=0 MODE=STRATEGY_ONLY DEPLOYED=NO [LONG_REDACTED] [LONG_REDACTED] BACKUP_HOSTKEYS=no PVE01_PUBLIC_SMOKE_BAD=0 INDEPENDENT_RUNNER=missing [LONG_REDACTED].md\"},{\"line\":109,\"text\":\"--- [LONG_REDACTED].txt\"},{\"line\":111,\"text\":\"SERVICE=netbird-vps-backup\"},{\"line\":113,\"text\":\"VPS_IP=188.127.235.6\"},{\"line\":114,\"text\":\"[LONG_REDACTED]\"},{\"line\":115,\"text\":\"[LONG_REDACTED]\"},{\"line\":119,\"text\":\"--- [LONG_REDACTED].txt\"},{\"line\":121,\"text\":\"SERVICE=netbird-vps-offhost\"},{\"line\":124,\"text\":\"[LONG_REDACTED]\"},{\"line\":129,\"text\":\"--- [LONG_REDACTED].txt\"},{\"line\":131,\"text\":\"SERVICE=netbird-vps-restore-validation\"},{\"line\":134,\"text\":\"[LONG_REDACTED].tgz\"},{\"line\":153,\"text\":\"edge-vm service=active/enabled wt0_ip=100.100.60.182/16 management=yes signal=yes peers=6/9 Connected\"}]\nNEWFI42_TEXT_FILES_SCANNED=336\nNEWFI42_TOPOLOGY_MATCH_FILE_COUNT=50\nNEWFI42_TOPOLOGY_MATCH_FILES_TRUNCATED=false\nNEWFI42_TOPOLOGY_MATCH_FILES=[{\"path\":\"/etc/pve/.rrd\",\"tags\":[\"EDGE_VM\"]},{\"path\":\"/etc/pve/HOMEPAGE_BACKUP_COVERAGE_MATRIX.md.bak-corrected-20260630T185336Z\",\"tags\":[\"ROUTER\"]},{\"path\":\"/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md\",\"tags\":[\"REJECTED_IP\",\"EDGE_VM\",\"PUBLIC_80_443\",\"NAT_FORWARD\",\"ROUTER\",\"TUNNEL\"]},{\"path\":\"/etc/pve/HOMEPAGE_BACKUP_COVERAGE_MATRIX.md\",\"tags\":[\"ROUTER\"]},{\"path\":\"/etc/pve/31_HOMELAB_REFERENCE.md\",\"tags\":[\"PUBLIC_IP\",\"EDGE_VM\",\"PUBLIC_80_443\",\"NAT_FORWARD\",\"ROUTER\",\"TUNNEL\"]},{\"path\":\"/etc/pve/HOMELAB_ASSISTANT_ERROR_REGISTER.md.bak-router-cli-20260630T215229Z\",\"tags\":[\"EDGE_VM\",\"NAT_FORWARD\",\"ROUTER\"]},{\"path\":\"/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md\",\"tags\":[\"REJECTED_IP\",\"EDGE_VM\",\"PUBLIC_80_443\",\"NAT_FORWARD\",\"ROUTER\",\"TUNNEL\"]},{\"path\":\"/etc/pve/HOMELAB_ASSISTANT_ERROR_REGISTER.md.bak.20260721T112115Z\",\"tags\":[\"EDGE_VM\",\"NAT_FORWARD\",\"ROUTER\",\"TUNNEL\"]},{\"path\":\"/etc/pve/HOMELAB_CLUSTER_BACKLOG.md\",\"tags\":[\"EDGE_VM\",\"ROUTER\"]},{\"path\":\"/etc/pve/HOMEPAGE_BACKUP_GAP_CLASSIFICATION.md\",\"tags\":[\"ROUTER\"]},{\"path\":\"/etc/pve/HOMELAB_ASSISTANT_ERROR_REGISTER.md\",\"tags\":[\"PUBLIC_IP\",\"EDGE_VM\",\"STAGING_HOST\",\"NAT_FORWARD\",\"ROUTER\",\"TUNNEL\"]},{\"path\":\"/etc/pve/HOMELAB_ASSISTANT_ERROR_REGISTER.md.bak-proof-repair-20260630T215529Z\",\"tags\":[\"EDGE_VM\",\"NAT_FORWARD\",\"ROUTER\"]},{\"path\":\"/etc/pve/priv/authorized_keys\",\"tags\":[\"EDGE_VM\",\"NAT_FORWARD\"]},{\"path\":\"/etc/pve/nodes/pve03/qemu-server/130.conf\",\"tags\":[\"EDGE_VM\"]},{\"path\":\"/var/lib/homelab-netbird-vps-trust/closure-latest.md\",\"tags\":[\"REJECTED_IP\",\"EDGE_VM\",\"NAT_FORWARD\"]},{\"path\":\"/var/lib/homelab-netbird-vps-trust/latest.md\",\"tags\":[\"REJECTED_IP\",\"EDGE_VM\"]},{\"path\":\"/var/lib/homelab-netbird-vps-trust/clean-seal-latest.md\",\"tags\":[\"REJECTED_IP\",\"EDGE_VM\"]},{\"path\":\"/srv/homelab-ops/observed/cluster-guests.json\",\"tags\":[\"EDGE_VM\"]},{\"path\":\"/srv/homelab-ops/observed/source-snapshots/dependency-map-latest.tsv\",\"tags\":[\"EDGE_VM\"]},{\"path\":\"/srv/homelab-ops/inventory/access-paths.json\",\"tags\":[\"EDGE_VM\"]},{\"path\":\"/srv/homelab-ops/changes/CR-2026-0081/home-forward-retire-package.sha256\",\"tags\":[\"PUBLIC_80_443\"]},{\"path\":\"/srv/homelab-ops/changes/CR-2026-0018/design.md\",\"tags\":[\"NAT_FORWARD\"]},{\"path\":\"/srv/homelab-ops/changes/CR-2026-0080/task-package.sha256\",\"tags\":[\"NAT_FORWARD\"]},{\"path\":\"/srv/homelab-ops/tasks/snikket-vm150-rebuild-v2/task.json\",\"tags\":[\"EDGE_VM\",\"NAT_FORWARD\",\"ROUTER\"]},{\"path\":\"/srv/homelab-ops/tasks/skladchik-reports-monitor-controlled-reauth-v1/assets/pve01/skladchik-reports-monitor-status\",\"tags\":[\"EDGE_VM\"]},{\"path\":\"/srv/homelab-ops/tasks/skladchik-reports-monitor-controlled-reauth-v1/assets/pve01/skladchik-reports-monitor-monthly-selftest-watch\",\"tags\":[\"EDGE_VM\"]},{\"path\":\"/srv/homelab-ops/tasks/snikket-edge-cutover-v1/task.json\",\"tags\":[\"PUBLIC_IP\",\"EDGE_VM\",\"NAT_FORWARD\",\"ROUTER\",\"TUNNEL\"]},{\"path\":\"/srv/homelab-ops/tasks/snikket-edge-cutover-v1/README.txt\",\"tags\":[\"PUBLIC_IP\",\"EDGE_VM\",\"NAT_FORWARD\",\"ROUTER\"]},{\"path\":\"/srv/homelab-ops/tasks/snikket-edge-cutover-v1/assets/edge01-home-restricted-ingress.nft\",\"tags\":[\"PUBLIC_IP\",\"NAT_FORWARD\"]},{\"path\":\"/srv/homelab-ops/tasks/snikket-edge-cutover-v1/assets/edge01-public-ingress.nft\",\"tags\":[\"PUBLIC_IP\",\"NAT_FORWARD\"]},{\"path\":\"/srv/homelab-ops/tasks/snikket-edge-cutover-v1/tools/cutover.py\",\"tags\":[\"PUBLIC_IP\",\"EDGE_VM\",\"NAT_FORWARD\",\"ROUTER\",\"TUNNEL\"]},{\"path\":\"/srv/homelab-ops/tasks/snikket-home-forward-retire-v1/task.json\",\"tags\":[\"PUBLIC_IP\",\"EDGE_VM\",\"PUBLIC_80_443\",\"ROUTER\"]},{\"path\":\"/srv/homelab-ops/tasks/snikket-home-forward-retire-v1/README.txt\",\"tags\":[\"ROUTER\"]},{\"path\":\"/srv/homelab-ops/tasks/snikket-home-forward-retire-v1/tools/retire_home_forwards.py\",\"tags\":[\"PUBLIC_IP\",\"ROUTER\"]},{\"path\":\"/srv/homelab-ops/tasks/snikket-turn-legacy-dns-retire-v1/task.json\",\"tags\":[\"PUBLIC_IP\",\"EDGE_VM\",\"ROUTER\"]},{\"path\":\"/srv/homelab-ops/tasks/snikket-turn-legacy-dns-retire-v1/README.txt\",\"tags\":[\"ROUTER\"]},{\"path\":\"/srv/homelab-ops/tasks/snikket-turn-legacy-dns-retire-v1/tools/retire_turn_dns.py\",\"tags\":[\"PUBLIC_IP\"]},{\"path\":\"/srv/homelab-ops/docs/superpowers/specs/2026-08-17-snikket-post-cutover-hardening-design.md\",\"tags\":[\"PUBLIC_IP\",\"ROUTER\"]},{\"path\":\"/srv/homelab-ops/docs/superpowers/specs/2026-08-18-gitea-edge-publisher-v3-design-v1.1.md\",\"tags\":[\"NAT_FORWARD\",\"TUNNEL\"]},{\"path\":\"/srv/homelab-ops/docs/superpowers/specs/2026-08-17-snikket-edge-cutover-design.md\",\"tags\":[\"PUBLIC_IP\",\"EDGE_VM\",\"PUBLIC_80_443\",\"NAT_FORWARD\",\"ROUTER\"]},{\"path\":\"/srv/homelab-ops/docs/superpowers/plans/2026-08-18-gitea-edge-publisher-v3.md\",\"tags\":[\"PUBLIC_IP\"]},{\"path\":\"/srv/homelab-ops/docs/superpowers/plans/2026-08-17-snikket-home-forward-retirement.md\",\"tags\":[\"PUBLIC_80_443\",\"NAT_FORWARD\",\"ROUTER\"]},{\"path\":\"/srv/homelab-ops/docs/superpowers/plans/2026-08-17-snikket-edge-cutover.md\",\"tags\":[\"PUBLIC_IP\",\"EDGE_VM\",\"PUBLIC_80_443\",\"NAT_FORWARD\",\"ROUTER\"]},{\"path\":\"/srv/homelab-ops/docs/superpowers/plans/2026-08-17-snikket-turn-legacy-dns-retirement.md\",\"tags\":[\"PUBLIC_IP\",\"EDGE_VM\",\"ROUTER\"]},{\"path\":\"/srv/homelab-ops/kb/AI_CONTEXT.md\",\"tags\":[\"PUBLIC_IP\",\"EDGE_VM\"]},{\"path\":\"/srv/homelab-ops/kb/inventory/guests.json\",\"tags\":[\"EDGE_VM\",\"NAT_FORWARD\",\"TUNNEL\"]},{\"path\":\"/srv/homelab-ops/kb/runbooks/03_EDGE_NGINX.md\",\"tags\":[\"PUBLIC_IP\"]},{\"path\":\"/srv/homelab-ops/tests/test_cr_2026_0080_snikket_edge_cutover.py\",\"tags\":[\"PUBLIC_IP\",\"NAT_FORWARD\",\"ROUTER\"]},{\"path\":\"/srv/homelab-ops/tests/test_cr_2026_0081_turn_dns_retire.py\",\"tags\":[\"ROUTER\"]},{\"path\":\"/srv/homelab-ops/tests/test_cr_2026_0081_home_forward_retire.py\",\"tags\":[\"PUBLIC_IP\",\"ROUTER\"]}]\nNEWFI42_OPS_GIT_STATUS_RC=0\nNEWFI42_OPS_GIT_STATUS_SHA256=5fbcb2990ad25e368c12219bf3ddca36e464d044e7acac16696fa8cd54159185\nNEWFI42_OPS_GIT_HEAD_RC=0\nNEWFI42_OPS_GIT_HEAD=d5e2ef5639398a762283e47143c17b494f8ed579\nNEWFI42_NETWORK_RELATED_UNIT_QUERY_RC=0\nNEWFI42_NETWORK_RELATED_UNITS=[{\"unit\":\"\\u25cf\",\"load\":\"gssproxy.service\",\"active\":\"not-found\",\"sub\":\"inactive\"},{\"unit\":\"netbird-peers-health.service\",\"load\":\"loaded\",\"active\":\"inactive\",\"sub\":\"dead\"},{\"unit\":\"netbird.service\",\"load\":\"loaded\",\"active\":\"active\",\"sub\":\"running\"},{\"unit\":\"pveproxy.service\",\"load\":\"loaded\",\"active\":\"active\",\"sub\":\"running\"},{\"unit\":\"spiceproxy.service\",\"load\":\"loaded\",\"active\":\"active\",\"sub\":\"running\"},{\"unit\":\"systemd-ask-password-wall.service\",\"load\":\"loaded\",\"active\":\"inactive\",\"sub\":\"dead\"}]\nNEWFI42_NFT_QUERY_RC=0\nNEWFI42_NFT_RELEVANT_RULE_COUNT=0\nNEWFI42_NFT_RELEVANT_LOCATIONS=[]\nNEWFI42_ROUTE_TO_PUBLIC_IP_RC=0\nNEWFI42_ROUTE_TO_PUBLIC_IP={\"dev\":\"vmbr0\",\"gateway_present\":true,\"gateway_sha256\":\"4f9da1283166a1e9f4e6bc7dd240c76aef85772177f717f92abb6e8e2bb8de90\",\"prefsrc_sha256\":\"fb345731d21c612ed2cb13088c10fd26bac959c79a7634cb55e23ee6bfb428d9\"}\nNEWFI42_DNS_A={\"newfi-staging.gram1.ru\":{\"ips\":[\"185.225.35.6\"],\"sources\":[\"getent\",\"dig\"]},\"chat.gram1.ru\":{\"ips\":[\"[PRIVATE_IP]\"],\"sources\":[\"getent\",\"dig\"]},\"git.gram1.ru\":{\"ips\":[\"[PRIVATE_IP]\"],\"sources\":[\"getent\",\"dig\"]},\"newfi.ru\":{\"ips\":[\"185.225.35.6\"],\"sources\":[\"getent\",\"dig\"]}}\nNEWFI42_DNS_STAGE_SHARES_IP_WITH_CHAT=false\nNEWFI42_DNS_STAGE_SHARES_IP_WITH_GIT=false\nNEWFI42_AUTHORITY_FORWARDING_ASSERTION_PRESENT=true\nNEWFI42_LOCAL_FORWARDING_RELATED_FILE_EVIDENCE=true\nNEWFI42_EXPLICIT_PUBLIC_IP_CONFIG_REFERENCE=true\nNEWFI42_DECISION=PUBLIC_INGRESS_CONTROL_PLANE_REFERENCE_FOUND_REVIEW_EXACT_MATCHED_PATHS_BEFORE_FIX\nNEWFI42_KNOWN_HOSTS_SHA256_AFTER=ab01de61ca5030ad158f1aef377364100531473de1e10a529089174f6890d735\nNEWFI42_KNOWN_HOSTS_UNCHANGED=true\nNEWFI42_CHANGES_MADE=false\nNEWFI42_MUTATION_SCOPE=NONE_READ_ONLY\nNEWFI42_RCA_EXECUTION=PASS\n" + "output": "ERROR_REGISTER_CHECK=OK\nREFERENCE_CHECK=OK\nAUTHORITY_CHECK_SCOPE=READABILITY_ONLY_INCIDENTS_NOT_CLOSED\nNEWFI43_RUNNER_SHA256=b248a4c32c9cc64e5747e7dce6c7fc0a23f5124a77c71ce72e27a81aceae9d2d\nNEWFI43_KNOWN_HOSTS_SHA256_BEFORE=ab01de61ca5030ad158f1aef377364100531473de1e10a529089174f6890d735\nNEWFI43_ERROR_ROUTER_CLUE_COUNT=13\nNEWFI43_ERROR_ROUTER_CLUES=[{\"line\":171,\"text\":\"Факт: first reconciliation wrote STATUS=ERROR because router-running-config-mail-cloud.txt is on pve01, not edge-vm.\"},{\"line\":214,\"text\":\"- Context: attempted Netcraze router ACL apply through SSH stdin/multiline for Homepage Moscow Router monitor fix.\"},{\"line\":217,\"text\":\"- Rule: do not apply Netcraze config through stdin/multiline SSH; prove CLI input mode first.\"},{\"line\":224,\"text\":\"## ROUTERBACKUP_READONLY_CLI_PERMISSION_LIMIT_20260630\"},{\"line\":225,\"text\":\"- Context: routerbackup user can run show running-config but cannot execute configuration commands such as access-list.\"},{\"line\":228,\"text\":\"- Rule: do not attempt ACL/config changes as routerbackup; use admin/operator router access or router Web UI for write changes.\"},{\"line\":239,\"text\":\"- Rule: after manual router Web UI ACL edits, compare _WEBADMIN_Bridge0, _WEBADMIN_Bridge1 and _WEBADMIN_GigabitEthernet1 before continuing.\"},{\"line\":250,\"text\":\"- Observed: edge-vm TCP to [PRIVATE_IP]:5080/5083 is OK, but router HTTP/HTTPS returns 403 for all tested paths.\"},{\"line\":265,\"text\":\"- Mitigation: use dedicated edge-vm health endpoint that checks router TCP [PRIVATE_IP]:5080 and returns HTTP 200/503 for Homepage.\"},{\"line\":598,\"text\":\"- Context: taftauto.ru points to the dacha router public IP. Operator confirmed the router model is Netcraze-like, same family as Moscow router.\"},{\"line\":604,\"text\":\"- Context: taftauto.ru points to the dacha router public IP. Operator confirmed the router model is Netcraze-like, same family as Moscow router.\"},{\"line\":612,\"text\":\"- Rule: generated client config may be stored only as root/debian mode 600 file and must be imported into the Netcraze router UI manually.\"},{\"line\":3180,\"text\":\"TAFTAUTO_INTERMITTENT_HTTP_TIMEOUT_20260904 | CLOSED_BLOCKED_REMOTE_SERVICE | VM130 route via wg-taftauto is healthy, WireGuard handshake is current, ICMP to [PRIVATE_IP] succeeds, but remote TCP/80 and TCP/443 are not listening. NPMplus/EDGE path is not the root cause; remediation requires the remote dacha service/router side.\"}]\nNEWFI43_REFERENCE_ROUTER_CLUE_COUNT=24\nNEWFI43_REFERENCE_ROUTER_CLUES=[{\"line\":199,\"text\":\"## ROUTER_NETCRAZE_ULTRA_NC1812_20260630\"},{\"line\":201,\"text\":\"Источник: self-test Netcraze Ultra NC-1812 от 2026-06-30. Секреты Wi-Fi, пароли и токены в справочник не вносятся.\"},{\"line\":204,\"text\":\"- Model: Netcraze Ultra.\"},{\"line\":205,\"text\":\"- Device description: Netcraze Ultra (NC-1812).\"},{\"line\":206,\"text\":\"- Hostname: Netcraze-9202.\"},{\"line\":211,\"text\":\"- Локальный домен/сертификат в логах: aleisaevn.netcraze.pro.\"},{\"line\":317,\"text\":\"- ISP tcp/443 -> bc:24:11:e1:f3:3c, NPMplus.\"},{\"line\":355,\"text\":\"- Netcraze SSH CLI is not a normal POSIX shell.\"},{\"line\":683,\"text\":\"- Public WAN router forwards TCP/80 and TCP/443 to NPMplus on edge-vm, [PRIVATE_IP].\"},{\"line\":694,\"text\":\"- Public listen ports on edge-vm: [PRIVATE_IP]:80 and [PRIVATE_IP]:443 by nginx/NPMplus.\"},{\"line\":1237,\"text\":\"- edge-vm exposes public :80/:443 through NPMplus.\"},{\"line\":1356,\"text\":\"- Public ingress HTTP/HTTPS: router forwards TCP 80/443 to edge-vm [PRIVATE_IP].\"},{\"line\":1367,\"text\":\"| gotify.gram1.ru | http://[PRIVATE_IP]:8082 | edge-vm / gotify | gotify health, alert-routing proof |\"},{\"line\":1368,\"text\":\"| vault.gram1.ru | http://[PRIVATE_IP]:8083 | edge-vm / vaultwarden | vaultwarden backup/offhost/restore |\"},{\"line\":1373,\"text\":\"| paper.gram1.ru | http://[PRIVATE_IP]:8010 | edge-vm / paperless | paperless backup/offhost/restore |\"},{\"line\":1626,\"text\":\"- Do not run bash/POSIX automation against Netcraze CLI; use router CLI syntax only.\"},{\"line\":1660,\"text\":\"- Timer: homelab-router-running-config-mail-cloud.timer.\"},{\"line\":1661,\"text\":\"- Health file: /var/lib/homelab-health/router-running-config-mail-cloud.txt.\"},{\"line\":1697,\"text\":\"- Router recurring backup uses a dedicated routerbackup credential file on pve01.\"},{\"line\":1698,\"text\":\"- Secret file path: /var/lib/homelab-private/secrets/routerbackup.pass.\"},{\"line\":2105,\"text\":\"- Netcraze routerbackup SSH access is read-only for backup: show running-config works, but ACL/config commands are denied.\"},{\"line\":2106,\"text\":\"- Homepage Moscow Router red-dot fix requires router ACL/Web UI/admin-level change, not routerbackup.\"},{\"line\":2498,\"text\":\"- Landing service on edge-vm: homelab-pvepro-landing-http.service on http://[PRIVATE_IP]:18089.\"},{\"line\":2511,\"text\":\"- Router model family: Netcraze-like, same as Moscow router family by operator statement.\"}]\nNEWFI43_TRUST_ROUTER_CLUE_COUNT=0\nNEWFI43_TRUST_ROUTER_CLUES=[]\nNEWFI43_EXPECTED_EDGE_ROUTER_TARGET_COUNT=1\nNEWFI43_EXPECTED_EDGE_ROUTER_TARGET_HASHES=[\"bc517b4af3298846906234d3d697d3820b0b652ade1880c937c9d71cd802c834\"]\nNEWFI43_ROUTER_SNAPSHOT_PRESENT=false\nNEWFI43_TEXT_FILES_SCANNED=265\nNEWFI43_ROUTERBACKUP_ENDPOINT_COUNT=0\nNEWFI43_ROUTERBACKUP_ENDPOINT_HASHES=[]\nNEWFI43_ROUTER_RELATED_FILE_COUNT=21\nNEWFI43_ROUTER_RELATED_FILES=[{\"path\":\"/etc/pve/HOMELAB_ASSISTANT_ERROR_REGISTER.md\",\"sha256\":\"3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0\",\"size\":302058},{\"path\":\"/etc/pve/31_HOMELAB_REFERENCE.md\",\"sha256\":\"5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d66\",\"size\":201129},{\"path\":\"/srv/homelab-ops/tasks/snikket-edge-cutover-v1/task.json\",\"sha256\":\"9cad3f6291663d6e85a556882c8ed751eaaa61b816b9bae934032fb0677267fd\",\"size\":5697},{\"path\":\"/srv/homelab-ops/tasks/snikket-edge-cutover-v1/README.txt\",\"sha256\":\"f01ab83f721cd4782e60ebc57316dcc753caf96e03598ce57ba829d47a8daeec\",\"size\":734},{\"path\":\"/srv/homelab-ops/tasks/snikket-edge-cutover-v1/assets/edge01-home-restricted-ingress.nft\",\"sha256\":\"124cf4df2391ce0256eceaf7a1470c8f53588c467de06af8a317bcc2ffdacfba\",\"size\":1460},{\"path\":\"/srv/homelab-ops/tasks/snikket-edge-cutover-v1/assets/edge01-public-ingress.nft\",\"sha256\":\"a195c34384dd7b2cdbdd83472bf5d527c3ba7b1c80d97a23562ddb703b1b7220\",\"size\":1281},{\"path\":\"/srv/homelab-ops/tasks/snikket-edge-cutover-v1/tools/cutover.py\",\"sha256\":\"0b17af22f494cd5e299fceae33c9bff114cefd5ab886426f0b822794a6787287\",\"size\":16029},{\"path\":\"/srv/homelab-ops/tasks/snikket-home-forward-retire-v1/task.json\",\"sha256\":\"26b81f4a16e66e5e1f6b09d6d600c17a86a87d6bf1eaddd506bb33555480c8a3\",\"size\":5352},{\"path\":\"/srv/homelab-ops/tasks/snikket-home-forward-retire-v1/tools/retire_home_forwards.py\",\"sha256\":\"e63317e9f5ed00b4535ccbd0930b305fdf847a44c5a67a9cc0e94c05106ff2f8\",\"size\":17076},{\"path\":\"/srv/homelab-ops/tasks/snikket-turn-legacy-dns-retire-v1/task.json\",\"sha256\":\"48564bec1e1dc49ba117ea2590f7922030462a0f4f71a62adf19a033ddaf74b4\",\"size\":5427},{\"path\":\"/srv/homelab-ops/tasks/snikket-turn-legacy-dns-retire-v1/tools/retire_turn_dns.py\",\"sha256\":\"33328864f5677f7a2962fccd1707e32e429a4d818fb45c7395efc1a67d829a27\",\"size\":13921},{\"path\":\"/srv/homelab-ops/docs/superpowers/specs/2026-08-17-snikket-post-cutover-hardening-design.md\",\"sha256\":\"da27ba7192019193cb08c6fead1e0fc847671121bea63735492e8123468b1837\",\"size\":3702},{\"path\":\"/srv/homelab-ops/docs/superpowers/specs/2026-08-17-snikket-edge-cutover-design.md\",\"sha256\":\"b774fe2d10c15832030192e475ba707fbe6e7d286fd079c4ffcaec013424bc6c\",\"size\":3638},{\"path\":\"/srv/homelab-ops/docs/superpowers/plans/2026-08-18-gitea-edge-publisher-v3.md\",\"sha256\":\"f42b0e0be98c7f6d9f0e06d5565ec1cfc277e4221cbc164f21c157fe4121ad72\",\"size\":31037},{\"path\":\"/srv/homelab-ops/docs/superpowers/plans/2026-08-17-snikket-home-forward-retirement.md\",\"sha256\":\"415c7f8302baf917e954118551ddcb507f8359418846bf4aa429c173b856f9a6\",\"size\":3408},{\"path\":\"/srv/homelab-ops/docs/superpowers/plans/2026-08-17-snikket-edge-cutover.md\",\"sha256\":\"db6119a6a40c326609f1041239ce465d6a3f1d8f169512296db7de5ae4316a74\",\"size\":4548},{\"path\":\"/srv/homelab-ops/docs/superpowers/plans/2026-08-17-snikket-turn-legacy-dns-retirement.md\",\"sha256\":\"a5b937405e9e073a31d11786f2300ed6acc9d8aeed4579c7bc19ec44ec83b907\",\"size\":5118},{\"path\":\"/srv/homelab-ops/kb/AI_CONTEXT.md\",\"sha256\":\"5fc43e34a1f0714ddacf7c00ed5c4bbaf788df3b8407dcfebd1333a23a623acc\",\"size\":3587},{\"path\":\"/srv/homelab-ops/kb/runbooks/03_EDGE_NGINX.md\",\"sha256\":\"ed07c49d6d425bed81b09004b7fec2844f38be270919bc04cb65c6b534a2b02b\",\"size\":650},{\"path\":\"/srv/homelab-ops/tests/test_cr_2026_0080_snikket_edge_cutover.py\",\"sha256\":\"a8b58624a22ea817b2696b50b3d410fb4cd23dd013f865d7d80ce465ebe8cf57\",\"size\":6137},{\"path\":\"/srv/homelab-ops/tests/test_cr_2026_0081_home_forward_retire.py\",\"sha256\":\"317aa49a5c23f395ca006b9e63cb26c298cb060e37e2cc26e9cd6783d777a468\",\"size\":6119}]\nNEWFI43_ROUTER_SCRIPT_CANDIDATES=[{\"path\":\"/srv/homelab-ops/tasks/snikket-home-forward-retire-v1/task.json\",\"sha256\":\"26b81f4a16e66e5e1f6b09d6d600c17a86a87d6bf1eaddd506bb33555480c8a3\",\"mode\":\"0o644\"},{\"path\":\"/srv/homelab-ops/tasks/snikket-home-forward-retire-v1/tools/retire_home_forwards.py\",\"sha256\":\"e63317e9f5ed00b4535ccbd0930b305fdf847a44c5a67a9cc0e94c05106ff2f8\",\"mode\":\"0o755\"}]\nNEWFI43_ROUTERBACKUP_READ_CAPABILITY_ASSERTED=true\nNEWFI43_ROUTERBACKUP_WRITE_DENIED_ASSERTED=true\nNEWFI43_ROUTER_WRITER_REFERENCE_PRESENT=true\nNEWFI43_ROUTER_EXISTING_KNOWN_HOST_MATCH_COUNT=0\nNEWFI43_ROUTER_LIVE_SHOW_RUNNING_CONFIG_RC=NOT_ATTEMPTED\nNEWFI43_SNAPSHOT_TARGET_RELATION=UNKNOWN\nNEWFI43_LIVE_TARGET_RELATION=UNKNOWN\nNEWFI43_DECISION=HOLD_ROUTERBACKUP_ENDPOINT_NOT_UNIQUE_REVIEW_EXACT_REFERENCES\nNEWFI43_KNOWN_HOSTS_SHA256_AFTER=ab01de61ca5030ad158f1aef377364100531473de1e10a529089174f6890d735\nNEWFI43_KNOWN_HOSTS_UNCHANGED=true\nNEWFI43_CHANGES_MADE=false\nNEWFI43_MUTATION_SCOPE=NONE_READ_ONLY\nNEWFI43_RCA_EXECUTION=PASS\n" } diff --git a/runtime/latest.txt b/runtime/latest.txt index 49976ec0..8a0451e1 100644 --- a/runtime/latest.txt +++ b/runtime/latest.txt @@ -1,15 +1,15 @@ CHAT_OUTPUT_BEGIN -COMMAND_ID=NEWFI-260908-A-STAGINGEDGE-PUBLICINGRESS-TOPOLOGY-RCA42 +COMMAND_ID=NEWFI-260908-A-STAGINGEDGE-PUBLICINGRESS-WRITERPATH-RCA43 STATUS=OK RC=0 HOST=pve01 MODE=read-only -COMPONENT=newfi-stagingedge-public-ingress-topology-rca-v6 +COMPONENT=newfi-stagingedge-public-ingress-router-live-writerpath-rca-v7 REFERENCE_REGISTER_CHECK=OK REFERENCE_SHA256=5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d66 ERROR_REGISTER_CHECK=OK ERROR_REGISTER_SHA256=3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0 -COMMAND_SHA256=8c1deae24d2c2e50bd7eca16ab18b10c78eb623b43884a033be8abcb060328de +COMMAND_SHA256=5d37f67460c7ccdd0ae041b342d7b75e929bf60333a13dd1b206e2befe296a6f DUPLICATE_FAILED_COMMAND_BLOCKED=false EXECUTION_STARTED=true CHANGE_DECLARED=false @@ -24,51 +24,42 @@ MUTATION_OUTCOME=NO_MUTATION SANITIZED=yes SECRETS_INCLUDED=no PRIVATE_ADDRESSES_INCLUDED=no -RAW_EVIDENCE_SHA256=475297be47aae03d0ef913ed8d3c90d3f0eabe4b0a86b02e6cccd5e805171e4f -SANITIZED_OUTPUT_SHA256=2740dbcc0eb7d919991be01db110d70f85f1c7ab59bcebf520b56960fa9399f9 +RAW_EVIDENCE_SHA256=a94b0dc6cf0dca478f6e33ea44afab6abb54befb21a9f4e5a10e819be229e2ad +SANITIZED_OUTPUT_SHA256=a94b0dc6cf0dca478f6e33ea44afab6abb54befb21a9f4e5a10e819be229e2ad OUTPUT_BEGIN ERROR_REGISTER_CHECK=OK REFERENCE_CHECK=OK AUTHORITY_CHECK_SCOPE=READABILITY_ONLY_INCIDENTS_NOT_CLOSED -NEWFI42_RUNNER_SHA256=b248a4c32c9cc64e5747e7dce6c7fc0a23f5124a77c71ce72e27a81aceae9d2d -NEWFI42_KNOWN_HOSTS_SHA256_BEFORE=ab01de61ca5030ad158f1aef377364100531473de1e10a529089174f6890d735 -NEWFI42_TRUST_FILE_PRESENT=true -NEWFI42_TRUST_FILE_SHA256=5ff80132df401240519f48091ed62c139183c325000ef7dd253e7f676a539b2c -NEWFI42_TRUST_EDGEVM_MARKER=true -NEWFI42_TRUST_REJECTED_MARKER=false -NEWFI42_ERROR_RELEVANT_LINE_COUNT=50 -NEWFI42_ERROR_RELEVANT_LINES=[{"line":19,"text":"CHECK-8: для edge-vm использовать debian@[PRIVATE_IP] и sudo."},{"line":28,"text":"VM130 edge-vm has secondary disk backup=0 risk."},{"line":52,"text":"edge-vm: ssh debian@[PRIVATE_IP], внутри использовать sudo."},{"line":170,"text":"41. Ошибка: post-backup-pass-slo-reconciliation checked pve01 router health on edge-vm."},{"line":171,"text":"Факт: first reconciliation wrote STATUS=ERROR because router-running-config-mail-cloud.txt is on pve01, not edge-vm."},{"line":172,"text":"Fix: build reconciliation from pve01 and edge-vm health files by correct owner."},{"line":213,"text":"## ROUTER_CLI_STDIN_APPLY_FAILURE_20260630"},{"line":214,"text":"- Context: attempted Netcraze router ACL apply through SSH stdin/multiline for Homepage Moscow Router monitor fix."},{"line":215,"text":"- Evidence: [LONG_REDACTED].txt."},{"line":219,"text":"## [LONG_REDACTED]"},{"line":221,"text":"- Evidence: [LONG_REDACTED].txt showed COMMAND_COUNT=1."},{"line":224,"text":"## [LONG_REDACTED]"},{"line":225,"text":"- Context: routerbackup user can run show running-config but cannot execute configuration commands such as access-list."},{"line":226,"text":"- Evidence: [LONG_REDACTED].txt."},{"line":228,"text":"- Rule: do not attempt ACL/config changes as routerbackup; use admin/operator router access or router Web UI for write changes."},{"line":232,"text":"- Evidence: [LONG_REDACTED].txt has blank [LONG_REDACTED] fields."},{"line":235,"text":"## [LONG_REDACTED]"},{"line":236,"text":"- Context: while moving Moscow Router monitor rules to _WEBADMIN_Bridge1, two _WEBADMIN_Bridge0 Nextcloud Talk TURN rules were accidentally removed."},{"line":238,"text":"- Verification proof: 399_ROUTER_ACL_RESTORE_AFTER_UI_PROOF.txt."},{"line":239,"text":"- Rule: after manual router Web UI ACL edits, compare _WEBADMIN_Bridge0, _WEBADMIN_Bridge1 and _WEBADMIN_GigabitEthernet1 before continuing."},{"line":241,"text":"## [LONG_REDACTED]"},{"line":242,"text":"- Context: proof 400 tested Moscow router HTTPS monitor from Homepage container with custom Node lookup callback."},{"line":247,"text":"## [LONG_REDACTED]"},{"line":248,"text":"- Context: Moscow Router Homepage monitor after ACL fix."},{"line":250,"text":"- Observed: edge-vm TCP to [PRIVATE_IP]:5080/5083 is OK, but router HTTP/HTTPS returns 403 for all tested paths."},{"line":251,"text":"- Impact: Homepage siteMonitor cannot be made green via direct router HTTP URL until router web service allows the Bridge1/Proxmox/protected segment or an explicit safe monitor endpoint is used."},{"line":255,"text":"- Context: installing edge-vm Moscow router health endpoint."},{"line":261,"text":"## [LONG_REDACTED]"},{"line":262,"text":"- Context: Moscow Router Homepage siteMonitor attempt using http://[PRIVATE_IP]:5080."},{"line":264,"text":"- Impact: do not use [PRIVATE_IP] directly as Homepage siteMonitor from edge-vm."},{"line":265,"text":"- Mitigation: use dedicated edge-vm health endpoint that checks router TCP [PRIVATE_IP]:5080 and returns HTTP 200/503 for Homepage."},{"line":267,"text":"## [LONG_REDACTED]"},{"line":268,"text":"- Context: applying Moscow Router Homepage siteMonitor health endpoint."},{"line":273,"text":"## [LONG_REDACTED]"},{"line":274,"text":"- Context: applying Moscow Router Homepage health endpoint."},{"line":276,"text":"- Evidence: proof 408 showed SyntaxError in /tmp/homepage-router-moscow-apply-fixed.py."},{"line":582,"text":"- Context: pvepro.ru root/www currently point to the Mailcow VPS and return Mailcow with TLS hostname mismatch."},{"line":583,"text":"- Decision: because pve01 has no SSH key access to the external VPS, do not modify the VPS. Instead move only pvepro.ru and www.pvepro.ru A records to edge and serve an edge landing page."},{"line":598,"text":"- Context: taftauto.ru points to the dacha router public IP. Operator confirmed the router model is Netcraze-like, same family as Moscow router."},{"line":599,"text":"- Current limitation: there is no safe private remote access path to the dacha router yet."},{"line":600,"text":"- Rule: do not expose router admin publicly and do not attempt certificate deployment to the router over the public internet."},{"line":604,"text":"- Context: taftauto.ru points to the dacha router public IP. Operator confirmed the router model is Netcraze-like, same family as Moscow router."},{"line":605,"text":"- Current limitation: there is no safe private remote access path to the dacha router yet."},{"line":606,"text":"- Rule: do not expose router admin publicly and do not attempt certificate deployment to the router over the public internet."},{"line":610,"text":"- Context: configuring private management path for taftauto.ru dacha router."},{"line":612,"text":"- Rule: generated client config may be stored only as root/debian mode 600 file and must be imported into the Netcraze router UI manually."},{"line":613,"text":"- Rule: do not open router public admin or certificate deployment until WireGuard handshake is proven."},{"line":626,"text":"- Fix: rebuild SmartApe under External Homelabs with 2-space item indentation, remove Router Moscow, rebuild Sites category."},{"line":647,"text":"## [LONG_REDACTED]"},{"line":648,"text":"- Previous apply looked for Russian Router card name, but active Homepage Useful group contains Router and Public Domain."}] -NEWFI42_REFERENCE_RELEVANT_LINE_COUNT=50 -NEWFI42_REFERENCE_RELEVANT_LINES=[{"line":14,"text":"- VM130 edge-vm | pve03 | running | KEEP"},{"line":75,"text":"NOTE edge-vm disk scsi1 backup=0 risk must be documented"},{"line":90,"text":"HEALTH_NOT_OK item=ingress-dns-route-slo.txt line=STATUS=WARN"},{"line":149,"text":"- У VM130 edge-vm есть риск: дополнительный диск backup=0."},{"line":166,"text":"- VM130 edge-vm pve03 [PRIVATE_IP] Docker ingress/app host."},{"line":199,"text":"## ROUTER_NETCRAZE_ULTRA_NC1812_20260630"},{"line":234,"text":"- WAN DHCP observed in router log: 95.84.154.183/23, gateway 95.84.154.1."},{"line":235,"text":"- ISP DNS observed in router log: 77.37.251.33, 77.37.255.30."},{"line":282,"text":"- Default router: [PRIVATE_IP]."},{"line":312,"text":"- [PRIVATE_IP] -> bc:24:11:e1:f3:3c NPMplus / edge-vm."},{"line":315,"text":"### NAT / port forwarding"},{"line":324,"text":"- _WEBADMIN_GigabitEthernet1 permits admin PC [PRIVATE_IP] outbound TCP 80/443."},{"line":327,"text":"### Router management"},{"line":333,"text":"- Telnet port configured: 2323, security-level private; router log shows Telnet disabled later on 2026-06-26."},{"line":339,"text":"### Router services"},{"line":354,"text":"### Router automation warning"},{"line":357,"text":"- Automation must use router CLI syntax, not bash syntax."},{"line":366,"text":"- edge-vm: no UPS/NUT/APCUPSD integration discovered."},{"line":371,"text":"- NetBird service is active on pve01, pve02, pve03 and edge-vm."},{"line":376,"text":"- edge-vm: FQDN edge-vm.netbird.selfhosted, IPv4 100.100.60.182/16."},{"line":395,"text":"- edge-vm owns most application health, dashboard, ingress, backup, NetBox, NPMplus, certificate, Trivy and vulnerability jobs."},{"line":396,"text":"- pve01 owns many [LONG_REDACTED] VPS/rclone/sops/scrutiny jobs."},{"line":455,"text":"- edge-vm timers cover runtime dashboard, Paperless guard, external canary, health metrics, restore drill index, AdGuard rewrite sync, NPMplus cert expiry, NetBox backup/sync, retention, cluster daily status, vulnerability and Trivy scans, ingress hardening an"},{"line":456,"text":"- pve01 timers cover VPN/NetBird health, health metrics, smartctl, disk space, MkDocs refresh, VPS identity audit, storage capacity, quality gate, evidence catalog, backup freshness, docker health, Filebrowser backup/offhost/restore, NPMplus/Kuma backup, NetBi"},{"line":459,"text":"- Script hashes were captured for /usr/local/sbin and /usr/local/bin on edge-vm, pve01, pve02 and pve03."},{"line":531,"text":"- Main active workload: VM130 edge-vm."},{"line":545,"text":"- Network: vmbr0, gateway [PRIVATE_IP]."},{"line":560,"text":"- Network: vmbr0, gateway [PRIVATE_IP]."},{"line":575,"text":"- Network: vmbr0, gateway [PRIVATE_IP]."},{"line":590,"text":"- Network: vmbr0, gateway [PRIVATE_IP]."},{"line":597,"text":"### VM130 edge-vm"},{"line":600,"text":"- Name: edge-vm."},{"line":608,"text":"- Network: vmbr0, gateway [PRIVATE_IP]."},{"line":626,"text":"- Network: vmbr0, gateway [PRIVATE_IP]."},{"line":643,"text":"- Network: vmbr0, gateway [PRIVATE_IP]."},{"line":653,"text":"## [LONG_REDACTED]"},{"line":672,"text":"- git.gram1.ru -> [PRIVATE_IP]."},{"line":682,"text":"### Router ingress"},{"line":683,"text":"- Public WAN router forwards TCP/80 and TCP/443 to NPMplus on edge-vm, [PRIVATE_IP]."},{"line":684,"text":"- Router forwards TCP/UDP 3478 to Nextcloud Talk TURN on [PRIVATE_IP]."},{"line":685,"text":"- Router forwards Home TCP/51820 to WireGuard host [PRIVATE_IP]."},{"line":686,"text":"- NPMplus admin listener is bound to localhost on edge-vm, [PRIVATE_IP]:81; public disabled legacy host npm.gram1.ru exists but enabled=0."},{"line":689,"text":"- Host: edge-vm, [PRIVATE_IP]."},{"line":694,"text":"- Public listen ports on edge-vm: [PRIVATE_IP]:80 and [PRIVATE_IP]:443 by nginx/NPMplus."},{"line":705,"text":"- git.gram1.ru -> http://[PRIVATE_IP]:3002, cert=29, ssl_forced=1, enabled=1."},{"line":754,"text":"- cert=29: git.gram1.ru, expires 2026-09-13 17:36:55."},{"line":762,"text":"- NPMplus schema/listen inventory: [LONG_REDACTED].txt."},{"line":769,"text":"- Host: edge-vm, IP [PRIVATE_IP]."},{"line":774,"text":"- Public ingress terminates through NPMplus on ports 80/443."},{"line":826,"text":"- Ingress/security: npmplus, socket-proxy, crowdsec."}] -NEWFI42_TRUST_RELEVANT_LINE_COUNT=37 -NEWFI42_TRUST_RELEVANT_LINES=[{"line":1,"text":"# NetBird VPS trust readiness"},{"line":14,"text":"public_ip=188.127.235.6"},{"line":21,"text":"netbird_vps_backup_ok=1"},{"line":22,"text":"netbird_vps_offhost_ok=1"},{"line":23,"text":"netbird_vps_restore_ok=1"},{"line":27,"text":"- Do not use public IP 188.127.235.6 until its host-key mismatch is intentionally resolved."},{"line":37,"text":"--- HOST=188.127.235.6"},{"line":39,"text":"KNOWN_FP host=188.127.235.6 256 SHA256:[LONG_REDACTED] |1|/0oIfigkDxhJFJWj72WrkRkYUqo=|29qT4RhgqPPXt3sOwBqw7QrafBY= (ECDSA)"},{"line":40,"text":"KNOWN_FP host=188.127.235.6 3072 SHA256:[LONG_REDACTED] |1|Hmbhg2wXCUS/SDiuLTTgk6Vxhns=|kw5S70w76UhROmk1XT92s4Z757Y= (RSA)"},{"line":41,"text":"KNOWN_FP host=188.127.235.6 256 SHA256:[LONG_REDACTED] |1|q70vtOfl5nR+CvnLuV7OQ3aEFIo=|OJi44TxJaz3cfw57HO19UEkZc/M= (ED25519)"},{"line":43,"text":"KEYSCAN_FP host=188.127.235.6 256 SHA256:[LONG_REDACTED] 188.127.235.6 (ED25519)"},{"line":44,"text":"KEYSCAN_FP host=188.127.235.6 3072 SHA256:[LONG_REDACTED] 188.127.235.6 (RSA)"},{"line":45,"text":"KEYSCAN_FP host=188.127.235.6 256 SHA256:[LONG_REDACTED] 188.127.235.6 (ECDSA)"},{"line":63,"text":"REMOTE_HOSTNAME=edge-vm"},{"line":71,"text":"256 SHA256:[LONG_REDACTED] root@edge-vm (ED25519)"},{"line":72,"text":"256 SHA256:[LONG_REDACTED] root@edge-vm (ECDSA)"},{"line":73,"text":"3072 SHA256:[LONG_REDACTED] root@edge-vm (RSA)"},{"line":77,"text":"REMOTE_HOSTNAME=edge-vm"},{"line":85,"text":"256 SHA256:[LONG_REDACTED] root@edge-vm (ED25519)"},{"line":86,"text":"256 SHA256:[LONG_REDACTED] root@edge-vm (ECDSA)"},{"line":87,"text":"3072 SHA256:[LONG_REDACTED] root@edge-vm (RSA)"},{"line":102,"text":"PUBLIC_STRICT ssh-keygen -f '[SENSITIVE_PATH] -R '188.127.235.6'"},{"line":103,"text":"PUBLIC_STRICT Host key for 188.127.235.6 has changed and you have requested strict checking."},{"line":107,"text":"--- [LONG_REDACTED].txt"},{"line":108,"text":"STATUS=OK TS=2026-07-07T15:15:14Z TYPE=external-probe-vps BAD=0 WARN=0 MODE=STRATEGY_ONLY DEPLOYED=NO [LONG_REDACTED] [LONG_REDACTED] BACKUP_HOSTKEYS=no PVE01_PUBLIC_SMOKE_BAD=0 INDEPENDENT_RUNNER=missing [LONG_REDACTED].md"},{"line":109,"text":"--- [LONG_REDACTED].txt"},{"line":111,"text":"SERVICE=netbird-vps-backup"},{"line":113,"text":"VPS_IP=188.127.235.6"},{"line":114,"text":"[LONG_REDACTED]"},{"line":115,"text":"[LONG_REDACTED]"},{"line":119,"text":"--- [LONG_REDACTED].txt"},{"line":121,"text":"SERVICE=netbird-vps-offhost"},{"line":124,"text":"[LONG_REDACTED]"},{"line":129,"text":"--- [LONG_REDACTED].txt"},{"line":131,"text":"SERVICE=netbird-vps-restore-validation"},{"line":134,"text":"[LONG_REDACTED].tgz"},{"line":153,"text":"edge-vm service=active/enabled wt0_ip=100.100.60.182/16 management=yes signal=yes peers=6/9 Connected"}] -NEWFI42_TEXT_FILES_SCANNED=336 -NEWFI42_TOPOLOGY_MATCH_FILE_COUNT=50 -NEWFI42_TOPOLOGY_MATCH_FILES_TRUNCATED=false -NEWFI42_TOPOLOGY_MATCH_FILES=[{"path":"/etc/pve/.rrd","tags":["EDGE_VM"]},{"path":"/etc/pve/HOMEPAGE_BACKUP_COVERAGE_MATRIX.md.bak-corrected-20260630T185336Z","tags":["ROUTER"]},{"path":"/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md","tags":["REJECTED_IP","EDGE_VM","PUBLIC_80_443","NAT_FORWARD","ROUTER","TUNNEL"]},{"path":"/etc/pve/HOMEPAGE_BACKUP_COVERAGE_MATRIX.md","tags":["ROUTER"]},{"path":"/etc/pve/31_HOMELAB_REFERENCE.md","tags":["PUBLIC_IP","EDGE_VM","PUBLIC_80_443","NAT_FORWARD","ROUTER","TUNNEL"]},{"path":"/etc/pve/HOMELAB_ASSISTANT_ERROR_REGISTER.md.bak-router-cli-20260630T215229Z","tags":["EDGE_VM","NAT_FORWARD","ROUTER"]},{"path":"/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md","tags":["REJECTED_IP","EDGE_VM","PUBLIC_80_443","NAT_FORWARD","ROUTER","TUNNEL"]},{"path":"/etc/pve/HOMELAB_ASSISTANT_ERROR_REGISTER.md.bak.20260721T112115Z","tags":["EDGE_VM","NAT_FORWARD","ROUTER","TUNNEL"]},{"path":"/etc/pve/HOMELAB_CLUSTER_BACKLOG.md","tags":["EDGE_VM","ROUTER"]},{"path":"/etc/pve/HOMEPAGE_BACKUP_GAP_CLASSIFICATION.md","tags":["ROUTER"]},{"path":"/etc/pve/HOMELAB_ASSISTANT_ERROR_REGISTER.md","tags":["PUBLIC_IP","EDGE_VM","STAGING_HOST","NAT_FORWARD","ROUTER","TUNNEL"]},{"path":"/etc/pve/HOMELAB_ASSISTANT_ERROR_REGISTER.md.bak-proof-repair-20260630T215529Z","tags":["EDGE_VM","NAT_FORWARD","ROUTER"]},{"path":"/etc/pve/priv/authorized_keys","tags":["EDGE_VM","NAT_FORWARD"]},{"path":"/etc/pve/nodes/pve03/qemu-server/130.conf","tags":["EDGE_VM"]},{"path":"/var/lib/homelab-netbird-vps-trust/closure-latest.md","tags":["REJECTED_IP","EDGE_VM","NAT_FORWARD"]},{"path":"/var/lib/homelab-netbird-vps-trust/latest.md","tags":["REJECTED_IP","EDGE_VM"]},{"path":"/var/lib/homelab-netbird-vps-trust/clean-seal-latest.md","tags":["REJECTED_IP","EDGE_VM"]},{"path":"/srv/homelab-ops/observed/cluster-guests.json","tags":["EDGE_VM"]},{"path":"/srv/homelab-ops/observed/source-snapshots/dependency-map-latest.tsv","tags":["EDGE_VM"]},{"path":"/srv/homelab-ops/inventory/access-paths.json","tags":["EDGE_VM"]},{"path":"/srv/homelab-ops/changes/CR-2026-0081/home-forward-retire-package.sha256","tags":["PUBLIC_80_443"]},{"path":"/srv/homelab-ops/changes/CR-2026-0018/design.md","tags":["NAT_FORWARD"]},{"path":"/srv/homelab-ops/changes/CR-2026-0080/task-package.sha256","tags":["NAT_FORWARD"]},{"path":"/srv/homelab-ops/tasks/snikket-vm150-rebuild-v2/task.json","tags":["EDGE_VM","NAT_FORWARD","ROUTER"]},{"path":"/srv/homelab-ops/tasks/skladchik-reports-monitor-controlled-reauth-v1/assets/pve01/skladchik-reports-monitor-status","tags":["EDGE_VM"]},{"path":"/srv/homelab-ops/tasks/skladchik-reports-monitor-controlled-reauth-v1/assets/pve01/skladchik-reports-monitor-monthly-selftest-watch","tags":["EDGE_VM"]},{"path":"/srv/homelab-ops/tasks/snikket-edge-cutover-v1/task.json","tags":["PUBLIC_IP","EDGE_VM","NAT_FORWARD","ROUTER","TUNNEL"]},{"path":"/srv/homelab-ops/tasks/snikket-edge-cutover-v1/README.txt","tags":["PUBLIC_IP","EDGE_VM","NAT_FORWARD","ROUTER"]},{"path":"/srv/homelab-ops/tasks/snikket-edge-cutover-v1/assets/edge01-home-restricted-ingress.nft","tags":["PUBLIC_IP","NAT_FORWARD"]},{"path":"/srv/homelab-ops/tasks/snikket-edge-cutover-v1/assets/edge01-public-ingress.nft","tags":["PUBLIC_IP","NAT_FORWARD"]},{"path":"/srv/homelab-ops/tasks/snikket-edge-cutover-v1/tools/cutover.py","tags":["PUBLIC_IP","EDGE_VM","NAT_FORWARD","ROUTER","TUNNEL"]},{"path":"/srv/homelab-ops/tasks/snikket-home-forward-retire-v1/task.json","tags":["PUBLIC_IP","EDGE_VM","PUBLIC_80_443","ROUTER"]},{"path":"/srv/homelab-ops/tasks/snikket-home-forward-retire-v1/README.txt","tags":["ROUTER"]},{"path":"/srv/homelab-ops/tasks/snikket-home-forward-retire-v1/tools/retire_home_forwards.py","tags":["PUBLIC_IP","ROUTER"]},{"path":"/srv/homelab-ops/tasks/snikket-turn-legacy-dns-retire-v1/task.json","tags":["PUBLIC_IP","EDGE_VM","ROUTER"]},{"path":"/srv/homelab-ops/tasks/snikket-turn-legacy-dns-retire-v1/README.txt","tags":["ROUTER"]},{"path":"/srv/homelab-ops/tasks/snikket-turn-legacy-dns-retire-v1/tools/retire_turn_dns.py","tags":["PUBLIC_IP"]},{"path":"/srv/homelab-ops/docs/superpowers/specs/2026-08-17-snikket-post-cutover-hardening-design.md","tags":["PUBLIC_IP","ROUTER"]},{"path":"/srv/homelab-ops/docs/superpowers/specs/2026-08-18-gitea-edge-publisher-v3-design-v1.1.md","tags":["NAT_FORWARD","TUNNEL"]},{"path":"/srv/homelab-ops/docs/superpowers/specs/2026-08-17-snikket-edge-cutover-design.md","tags":["PUBLIC_IP","EDGE_VM","PUBLIC_80_443","NAT_FORWARD","ROUTER"]},{"path":"/srv/homelab-ops/docs/superpowers/plans/2026-08-18-gitea-edge-publisher-v3.md","tags":["PUBLIC_IP"]},{"path":"/srv/homelab-ops/docs/superpowers/plans/2026-08-17-snikket-home-forward-retirement.md","tags":["PUBLIC_80_443","NAT_FORWARD","ROUTER"]},{"path":"/srv/homelab-ops/docs/superpowers/plans/2026-08-17-snikket-edge-cutover.md","tags":["PUBLIC_IP","EDGE_VM","PUBLIC_80_443","NAT_FORWARD","ROUTER"]},{"path":"/srv/homelab-ops/docs/superpowers/plans/2026-08-17-snikket-turn-legacy-dns-retirement.md","tags":["PUBLIC_IP","EDGE_VM","ROUTER"]},{"path":"/srv/homelab-ops/kb/AI_CONTEXT.md","tags":["PUBLIC_IP","EDGE_VM"]},{"path":"/srv/homelab-ops/kb/inventory/guests.json","tags":["EDGE_VM","NAT_FORWARD","TUNNEL"]},{"path":"/srv/homelab-ops/kb/runbooks/03_EDGE_NGINX.md","tags":["PUBLIC_IP"]},{"path":"/srv/homelab-ops/tests/test_cr_2026_0080_snikket_edge_cutover.py","tags":["PUBLIC_IP","NAT_FORWARD","ROUTER"]},{"path":"/srv/homelab-ops/tests/test_cr_2026_0081_turn_dns_retire.py","tags":["ROUTER"]},{"path":"/srv/homelab-ops/tests/test_cr_2026_0081_home_forward_retire.py","tags":["PUBLIC_IP","ROUTER"]}] -NEWFI42_OPS_GIT_STATUS_RC=0 -NEWFI42_OPS_GIT_STATUS_SHA256=5fbcb2990ad25e368c12219bf3ddca36e464d044e7acac16696fa8cd54159185 -NEWFI42_OPS_GIT_HEAD_RC=0 -NEWFI42_OPS_GIT_HEAD=d5e2ef5639398a762283e47143c17b494f8ed579 -NEWFI42_NETWORK_RELATED_UNIT_QUERY_RC=0 -NEWFI42_NETWORK_RELATED_UNITS=[{"unit":"\u25cf","load":"gssproxy.service","active":"not-found","sub":"inactive"},{"unit":"netbird-peers-health.service","load":"loaded","active":"inactive","sub":"dead"},{"unit":"netbird.service","load":"loaded","active":"active","sub":"running"},{"unit":"pveproxy.service","load":"loaded","active":"active","sub":"running"},{"unit":"spiceproxy.service","load":"loaded","active":"active","sub":"running"},{"unit":"systemd-ask-password-wall.service","load":"loaded","active":"inactive","sub":"dead"}] -NEWFI42_NFT_QUERY_RC=0 -NEWFI42_NFT_RELEVANT_RULE_COUNT=0 -NEWFI42_NFT_RELEVANT_LOCATIONS=[] -NEWFI42_ROUTE_TO_PUBLIC_IP_RC=0 -NEWFI42_ROUTE_TO_PUBLIC_IP={"dev":"vmbr0","gateway_present":true,"gateway_sha256":"4f9da1283166a1e9f4e6bc7dd240c76aef85772177f717f92abb6e8e2bb8de90","prefsrc_sha256":"fb345731d21c612ed2cb13088c10fd26bac959c79a7634cb55e23ee6bfb428d9"} -NEWFI42_DNS_A={"newfi-staging.gram1.ru":{"ips":["185.225.35.6"],"sources":["getent","dig"]},"chat.gram1.ru":{"ips":["[PRIVATE_IP]"],"sources":["getent","dig"]},"git.gram1.ru":{"ips":["[PRIVATE_IP]"],"sources":["getent","dig"]},"newfi.ru":{"ips":["185.225.35.6"],"sources":["getent","dig"]}} -NEWFI42_DNS_STAGE_SHARES_IP_WITH_CHAT=false -NEWFI42_DNS_STAGE_SHARES_IP_WITH_GIT=false -NEWFI42_AUTHORITY_FORWARDING_ASSERTION_PRESENT=true -NEWFI42_LOCAL_FORWARDING_RELATED_FILE_EVIDENCE=true -NEWFI42_EXPLICIT_PUBLIC_IP_CONFIG_REFERENCE=true -NEWFI42_DECISION=PUBLIC_INGRESS_CONTROL_PLANE_REFERENCE_FOUND_REVIEW_EXACT_MATCHED_PATHS_BEFORE_FIX -NEWFI42_KNOWN_HOSTS_SHA256_AFTER=ab01de61ca5030ad158f1aef377364100531473de1e10a529089174f6890d735 -NEWFI42_KNOWN_HOSTS_UNCHANGED=true -NEWFI42_CHANGES_MADE=false -NEWFI42_MUTATION_SCOPE=NONE_READ_ONLY -NEWFI42_RCA_EXECUTION=PASS +NEWFI43_RUNNER_SHA256=b248a4c32c9cc64e5747e7dce6c7fc0a23f5124a77c71ce72e27a81aceae9d2d +NEWFI43_KNOWN_HOSTS_SHA256_BEFORE=ab01de61ca5030ad158f1aef377364100531473de1e10a529089174f6890d735 +NEWFI43_ERROR_ROUTER_CLUE_COUNT=13 +NEWFI43_ERROR_ROUTER_CLUES=[{"line":171,"text":"Факт: first reconciliation wrote STATUS=ERROR because router-running-config-mail-cloud.txt is on pve01, not edge-vm."},{"line":214,"text":"- Context: attempted Netcraze router ACL apply through SSH stdin/multiline for Homepage Moscow Router monitor fix."},{"line":217,"text":"- Rule: do not apply Netcraze config through stdin/multiline SSH; prove CLI input mode first."},{"line":224,"text":"## ROUTERBACKUP_READONLY_CLI_PERMISSION_LIMIT_20260630"},{"line":225,"text":"- Context: routerbackup user can run show running-config but cannot execute configuration commands such as access-list."},{"line":228,"text":"- Rule: do not attempt ACL/config changes as routerbackup; use admin/operator router access or router Web UI for write changes."},{"line":239,"text":"- Rule: after manual router Web UI ACL edits, compare _WEBADMIN_Bridge0, _WEBADMIN_Bridge1 and _WEBADMIN_GigabitEthernet1 before continuing."},{"line":250,"text":"- Observed: edge-vm TCP to [PRIVATE_IP]:5080/5083 is OK, but router HTTP/HTTPS returns 403 for all tested paths."},{"line":265,"text":"- Mitigation: use dedicated edge-vm health endpoint that checks router TCP [PRIVATE_IP]:5080 and returns HTTP 200/503 for Homepage."},{"line":598,"text":"- Context: taftauto.ru points to the dacha router public IP. Operator confirmed the router model is Netcraze-like, same family as Moscow router."},{"line":604,"text":"- Context: taftauto.ru points to the dacha router public IP. Operator confirmed the router model is Netcraze-like, same family as Moscow router."},{"line":612,"text":"- Rule: generated client config may be stored only as root/debian mode 600 file and must be imported into the Netcraze router UI manually."},{"line":3180,"text":"TAFTAUTO_INTERMITTENT_HTTP_TIMEOUT_20260904 | CLOSED_BLOCKED_REMOTE_SERVICE | VM130 route via wg-taftauto is healthy, WireGuard handshake is current, ICMP to [PRIVATE_IP] succeeds, but remote TCP/80 and TCP/443 are not listening. NPMplus/EDGE path is not the root cause; remediation requires the remote dacha service/router side."}] +NEWFI43_REFERENCE_ROUTER_CLUE_COUNT=24 +NEWFI43_REFERENCE_ROUTER_CLUES=[{"line":199,"text":"## ROUTER_NETCRAZE_ULTRA_NC1812_20260630"},{"line":201,"text":"Источник: self-test Netcraze Ultra NC-1812 от 2026-06-30. Секреты Wi-Fi, пароли и токены в справочник не вносятся."},{"line":204,"text":"- Model: Netcraze Ultra."},{"line":205,"text":"- Device description: Netcraze Ultra (NC-1812)."},{"line":206,"text":"- Hostname: Netcraze-9202."},{"line":211,"text":"- Локальный домен/сертификат в логах: aleisaevn.netcraze.pro."},{"line":317,"text":"- ISP tcp/443 -> bc:24:11:e1:f3:3c, NPMplus."},{"line":355,"text":"- Netcraze SSH CLI is not a normal POSIX shell."},{"line":683,"text":"- Public WAN router forwards TCP/80 and TCP/443 to NPMplus on edge-vm, [PRIVATE_IP]."},{"line":694,"text":"- Public listen ports on edge-vm: [PRIVATE_IP]:80 and [PRIVATE_IP]:443 by nginx/NPMplus."},{"line":1237,"text":"- edge-vm exposes public :80/:443 through NPMplus."},{"line":1356,"text":"- Public ingress HTTP/HTTPS: router forwards TCP 80/443 to edge-vm [PRIVATE_IP]."},{"line":1367,"text":"| gotify.gram1.ru | http://[PRIVATE_IP]:8082 | edge-vm / gotify | gotify health, alert-routing proof |"},{"line":1368,"text":"| vault.gram1.ru | http://[PRIVATE_IP]:8083 | edge-vm / vaultwarden | vaultwarden backup/offhost/restore |"},{"line":1373,"text":"| paper.gram1.ru | http://[PRIVATE_IP]:8010 | edge-vm / paperless | paperless backup/offhost/restore |"},{"line":1626,"text":"- Do not run bash/POSIX automation against Netcraze CLI; use router CLI syntax only."},{"line":1660,"text":"- Timer: homelab-router-running-config-mail-cloud.timer."},{"line":1661,"text":"- Health file: /var/lib/homelab-health/router-running-config-mail-cloud.txt."},{"line":1697,"text":"- Router recurring backup uses a dedicated routerbackup credential file on pve01."},{"line":1698,"text":"- Secret file path: /var/lib/homelab-private/secrets/routerbackup.pass."},{"line":2105,"text":"- Netcraze routerbackup SSH access is read-only for backup: show running-config works, but ACL/config commands are denied."},{"line":2106,"text":"- Homepage Moscow Router red-dot fix requires router ACL/Web UI/admin-level change, not routerbackup."},{"line":2498,"text":"- Landing service on edge-vm: homelab-pvepro-landing-http.service on http://[PRIVATE_IP]:18089."},{"line":2511,"text":"- Router model family: Netcraze-like, same as Moscow router family by operator statement."}] +NEWFI43_TRUST_ROUTER_CLUE_COUNT=0 +NEWFI43_TRUST_ROUTER_CLUES=[] +NEWFI43_EXPECTED_EDGE_ROUTER_TARGET_COUNT=1 +NEWFI43_EXPECTED_EDGE_ROUTER_TARGET_HASHES=["bc517b4af3298846906234d3d697d3820b0b652ade1880c937c9d71cd802c834"] +NEWFI43_ROUTER_SNAPSHOT_PRESENT=false +NEWFI43_TEXT_FILES_SCANNED=265 +NEWFI43_ROUTERBACKUP_ENDPOINT_COUNT=0 +NEWFI43_ROUTERBACKUP_ENDPOINT_HASHES=[] +NEWFI43_ROUTER_RELATED_FILE_COUNT=21 +NEWFI43_ROUTER_RELATED_FILES=[{"path":"/etc/pve/HOMELAB_ASSISTANT_ERROR_REGISTER.md","sha256":"3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0","size":302058},{"path":"/etc/pve/31_HOMELAB_REFERENCE.md","sha256":"5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d66","size":201129},{"path":"/srv/homelab-ops/tasks/snikket-edge-cutover-v1/task.json","sha256":"9cad3f6291663d6e85a556882c8ed751eaaa61b816b9bae934032fb0677267fd","size":5697},{"path":"/srv/homelab-ops/tasks/snikket-edge-cutover-v1/README.txt","sha256":"f01ab83f721cd4782e60ebc57316dcc753caf96e03598ce57ba829d47a8daeec","size":734},{"path":"/srv/homelab-ops/tasks/snikket-edge-cutover-v1/assets/edge01-home-restricted-ingress.nft","sha256":"124cf4df2391ce0256eceaf7a1470c8f53588c467de06af8a317bcc2ffdacfba","size":1460},{"path":"/srv/homelab-ops/tasks/snikket-edge-cutover-v1/assets/edge01-public-ingress.nft","sha256":"a195c34384dd7b2cdbdd83472bf5d527c3ba7b1c80d97a23562ddb703b1b7220","size":1281},{"path":"/srv/homelab-ops/tasks/snikket-edge-cutover-v1/tools/cutover.py","sha256":"0b17af22f494cd5e299fceae33c9bff114cefd5ab886426f0b822794a6787287","size":16029},{"path":"/srv/homelab-ops/tasks/snikket-home-forward-retire-v1/task.json","sha256":"26b81f4a16e66e5e1f6b09d6d600c17a86a87d6bf1eaddd506bb33555480c8a3","size":5352},{"path":"/srv/homelab-ops/tasks/snikket-home-forward-retire-v1/tools/retire_home_forwards.py","sha256":"e63317e9f5ed00b4535ccbd0930b305fdf847a44c5a67a9cc0e94c05106ff2f8","size":17076},{"path":"/srv/homelab-ops/tasks/snikket-turn-legacy-dns-retire-v1/task.json","sha256":"48564bec1e1dc49ba117ea2590f7922030462a0f4f71a62adf19a033ddaf74b4","size":5427},{"path":"/srv/homelab-ops/tasks/snikket-turn-legacy-dns-retire-v1/tools/retire_turn_dns.py","sha256":"33328864f5677f7a2962fccd1707e32e429a4d818fb45c7395efc1a67d829a27","size":13921},{"path":"/srv/homelab-ops/docs/superpowers/specs/2026-08-17-snikket-post-cutover-hardening-design.md","sha256":"da27ba7192019193cb08c6fead1e0fc847671121bea63735492e8123468b1837","size":3702},{"path":"/srv/homelab-ops/docs/superpowers/specs/2026-08-17-snikket-edge-cutover-design.md","sha256":"b774fe2d10c15832030192e475ba707fbe6e7d286fd079c4ffcaec013424bc6c","size":3638},{"path":"/srv/homelab-ops/docs/superpowers/plans/2026-08-18-gitea-edge-publisher-v3.md","sha256":"f42b0e0be98c7f6d9f0e06d5565ec1cfc277e4221cbc164f21c157fe4121ad72","size":31037},{"path":"/srv/homelab-ops/docs/superpowers/plans/2026-08-17-snikket-home-forward-retirement.md","sha256":"415c7f8302baf917e954118551ddcb507f8359418846bf4aa429c173b856f9a6","size":3408},{"path":"/srv/homelab-ops/docs/superpowers/plans/2026-08-17-snikket-edge-cutover.md","sha256":"db6119a6a40c326609f1041239ce465d6a3f1d8f169512296db7de5ae4316a74","size":4548},{"path":"/srv/homelab-ops/docs/superpowers/plans/2026-08-17-snikket-turn-legacy-dns-retirement.md","sha256":"a5b937405e9e073a31d11786f2300ed6acc9d8aeed4579c7bc19ec44ec83b907","size":5118},{"path":"/srv/homelab-ops/kb/AI_CONTEXT.md","sha256":"5fc43e34a1f0714ddacf7c00ed5c4bbaf788df3b8407dcfebd1333a23a623acc","size":3587},{"path":"/srv/homelab-ops/kb/runbooks/03_EDGE_NGINX.md","sha256":"ed07c49d6d425bed81b09004b7fec2844f38be270919bc04cb65c6b534a2b02b","size":650},{"path":"/srv/homelab-ops/tests/test_cr_2026_0080_snikket_edge_cutover.py","sha256":"a8b58624a22ea817b2696b50b3d410fb4cd23dd013f865d7d80ce465ebe8cf57","size":6137},{"path":"/srv/homelab-ops/tests/test_cr_2026_0081_home_forward_retire.py","sha256":"317aa49a5c23f395ca006b9e63cb26c298cb060e37e2cc26e9cd6783d777a468","size":6119}] +NEWFI43_ROUTER_SCRIPT_CANDIDATES=[{"path":"/srv/homelab-ops/tasks/snikket-home-forward-retire-v1/task.json","sha256":"26b81f4a16e66e5e1f6b09d6d600c17a86a87d6bf1eaddd506bb33555480c8a3","mode":"0o644"},{"path":"/srv/homelab-ops/tasks/snikket-home-forward-retire-v1/tools/retire_home_forwards.py","sha256":"e63317e9f5ed00b4535ccbd0930b305fdf847a44c5a67a9cc0e94c05106ff2f8","mode":"0o755"}] +NEWFI43_ROUTERBACKUP_READ_CAPABILITY_ASSERTED=true +NEWFI43_ROUTERBACKUP_WRITE_DENIED_ASSERTED=true +NEWFI43_ROUTER_WRITER_REFERENCE_PRESENT=true +NEWFI43_ROUTER_EXISTING_KNOWN_HOST_MATCH_COUNT=0 +NEWFI43_ROUTER_LIVE_SHOW_RUNNING_CONFIG_RC=NOT_ATTEMPTED +NEWFI43_SNAPSHOT_TARGET_RELATION=UNKNOWN +NEWFI43_LIVE_TARGET_RELATION=UNKNOWN +NEWFI43_DECISION=HOLD_ROUTERBACKUP_ENDPOINT_NOT_UNIQUE_REVIEW_EXACT_REFERENCES +NEWFI43_KNOWN_HOSTS_SHA256_AFTER=ab01de61ca5030ad158f1aef377364100531473de1e10a529089174f6890d735 +NEWFI43_KNOWN_HOSTS_UNCHANGED=true +NEWFI43_CHANGES_MADE=false +NEWFI43_MUTATION_SCOPE=NONE_READ_ONLY +NEWFI43_RCA_EXECUTION=PASS OUTPUT_END CHAT_OUTPUT_END