>>> [00] VM100 Git candidate content review
DATE_UTC=2026-07-13T06:34:02Z
OPENWRT_RELEASE=
VM100_MODIFIED=false

>>> [01] Candidate existence and metadata
FILE path=/etc/config/pbr mode=-rw------- size=1208 sha256=60f20c47e0b24de5a7a7531ba1c1eba39e3ba97d794c17cef61921d41cfcb96c
FILE path=/etc/config/firewall mode=-rw-r--r-- size=2978 sha256=6bd0b24a89d31c7bcf2bec706c0d65efc503b0f57e19a109efc1e109eb55a2a3
FILE path=/etc/config/dhcp mode=-rw------- size=1050 sha256=b09040864b00ab800232b3c004fb24a61aec36bd98fe573ff9dfcf4bcb971ce1
FILE path=/etc/pbr.d/default_lan_to_vpn.sh mode=-rwxr-xr-x size=313 sha256=4b1a0f56e5b61582ebf97ccae4d5e2c74b071124de1a1b81dcd39143baa1866e
FILE path=/etc/pbr.d/ru_to_direct.sh mode=-rwxr-xr-x size=339 sha256=945751b3fe3510c1ace200dfae126f539ec006c99e4704a2f39688684f7519bc
FILE path=/etc/hotplug.d/iface/99-pbr-delayed-restart mode=-rwxr-xr-x size=851 sha256=cb61ca54d2882e29aea7db396eb7936ad5e3f531496b8b35df37d42b32cbc69b
FILE path=/etc/init.d/router-egress-activity mode=-rwxr-xr-x size=429 sha256=0a2000780177c46330da4dce141fe1e947f3cdbd4e10f2518bfb31dbe44a5645
FILE path=/etc/init.d/router-wgpay-canary mode=-rwxr-xr-x size=233 sha256=305468309ddd0e0c242d5b187701f86351a60f8e13a083c343ecdf998ec2a2ed
FILE path=/etc/init.d/router-wgpay-egress-local mode=-rwxr-xr-x size=333 sha256=20e0d75d573e71df5438d4f25c4b5fdf0fc67250cc5fba1a1798ad7f47be644e
FILE path=/usr/local/sbin/router-egress-activity-apply.sh mode=-rwxr-xr-x size=312 sha256=2625c5c22d5b72557b413e61501e70ffb65ed4ead2fddb2c3a60f224c18c7574
FILE path=/usr/local/sbin/router-egress-activity-read.sh mode=-rwxr-xr-x size=128 sha256=f0ce797cc9615126d63b9447259bc7fffd654708492d811dff177b3a7b877c85
FILE path=/usr/local/sbin/router-wgpay-canary-apply.sh mode=-rwxr-xr-x size=1826 sha256=00c06f11ce4143834043e480fc1c28f26afee22fe1f313670546bd5dd71aee69
FILE path=/usr/local/sbin/router-wgpay-egress-local-loop.sh mode=-rwx------ size=1975 sha256=8870b71a6c87b00f4ba20f76a5b39efb5ed15e0e482fc5f7ca7d499b30cc3010
FILE path=/usr/local/sbin/router-wgpay-egress-local.sh mode=-rwx------ size=14236 sha256=f9432a39be5555dad13132eb5f089f7b638956027c9c060e98de29743bc7d88a
FILE path=/etc/router-egress-activity/router_egress_activity.nft mode=-rw-r--r-- size=2132 sha256=78240f39d95d3319e2cc5db1ea33c3bf4181853efede8cce04118ae048142b8a
FILE path=/etc/router-wgpay-egress-local.conf mode=-rw------- size=479 sha256=90797d54fbb0bd46388b54ef81fd578f86377aa7a202698f0767bb413e432557
FILE path=/etc/nftables.d/10-custom-filter-chains.nft mode=-rw-r--r-- size=1139 sha256=af5cbfeb3e3b61d32ce134ae33d15330ee27da838e6f4fb9c717f034923b8b16
FILE path=/etc/nftables.d/90-wg-remote-snat-to-pc.nft mode=-rw-r--r-- size=222 sha256=c9acec388d3509dd39496e8c68f787969705b9544f1646464f2ea950f4d5a21a
MISSING=/etc/crontabs/root
FILE path=/etc/rc.local mode=-rw-r--r-- size=132 sha256=515018aa94eb4937dade12dc0d69890b352af35a5ab5fb8203f9ed10990ac06f

>>> [02] High-confidence secret scan
HIGH_CONFIDENCE_CLEAR=/etc/config/pbr
HIGH_CONFIDENCE_CLEAR=/etc/config/firewall
HIGH_CONFIDENCE_CLEAR=/etc/config/dhcp
HIGH_CONFIDENCE_CLEAR=/etc/pbr.d/default_lan_to_vpn.sh
HIGH_CONFIDENCE_CLEAR=/etc/pbr.d/ru_to_direct.sh
HIGH_CONFIDENCE_CLEAR=/etc/hotplug.d/iface/99-pbr-delayed-restart
HIGH_CONFIDENCE_CLEAR=/etc/init.d/router-egress-activity
HIGH_CONFIDENCE_CLEAR=/etc/init.d/router-wgpay-canary
HIGH_CONFIDENCE_CLEAR=/etc/init.d/router-wgpay-egress-local
HIGH_CONFIDENCE_CLEAR=/usr/local/sbin/router-egress-activity-apply.sh
HIGH_CONFIDENCE_CLEAR=/usr/local/sbin/router-egress-activity-read.sh
HIGH_CONFIDENCE_CLEAR=/usr/local/sbin/router-wgpay-canary-apply.sh
HIGH_CONFIDENCE_CLEAR=/usr/local/sbin/router-wgpay-egress-local-loop.sh
HIGH_CONFIDENCE_CLEAR=/usr/local/sbin/router-wgpay-egress-local.sh
HIGH_CONFIDENCE_CLEAR=/etc/router-egress-activity/router_egress_activity.nft
HIGH_CONFIDENCE_CLEAR=/etc/router-wgpay-egress-local.conf
HIGH_CONFIDENCE_CLEAR=/etc/nftables.d/10-custom-filter-chains.nft
HIGH_CONFIDENCE_CLEAR=/etc/nftables.d/90-wg-remote-snat-to-pc.nft
HIGH_CONFIDENCE_CLEAR=/etc/rc.local

>>> [03] Keyword-only review

>>> [04] Candidate contents

===== FILE BEGIN: /etc/config/pbr =====

config pbr 'config'
	option enabled '1'
	option fw_mask '00ff0000'
	option ipv6_enabled '0'
	option nft_rule_counter '0'
	option nft_set_auto_merge '1'
	option nft_set_counter '0'
	option nft_set_flags_interval '1'
	option nft_set_flags_timeout '0'
	option nft_set_policy 'performance'
	option nft_user_set_counter '0'
	option procd_boot_trigger_delay '5000'
	option procd_reload_delay '0'
	option resolver_set 'dnsmasq.nftset'
	option strict_enforcement '1'
	option uplink_ip_rules_priority '30000'
	option uplink_mark '00010000'
	option verbosity '2'
	option lan_device 'br-lan'
	list resolver_instance '*'
	list webui_supported_protocol 'all'
	list webui_supported_protocol 'tcp'
	list webui_supported_protocol 'udp'
	list webui_supported_protocol 'tcp udp'
	list webui_supported_protocol 'icmp'
	option config_compat '25'
	option config_version '1.2.2-r12'
	option rule_create_option 'add'
	option webui_show_ignore_target '1'
	list supported_interface 'transit_direct'
	list supported_interface 'transit_vpn'
	option uplink_interface 'transit_direct'

config policy
	option name 'IGNORE_ADMIN_WG_TO_LAN'
	option src_addr '10.250.100.0/24'
	option dest_addr '10.71.100.0/24'
	option interface 'ignore'

===== FILE END: /etc/config/pbr =====

===== FILE BEGIN: /etc/config/firewall =====

config defaults
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option synflood_protect '1'

config zone
	option name 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	list network 'lan'

config zone
	option name 'transit_direct'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'REJECT'
	list network 'transit_direct'
	option masq '1'
	option mtu_fix '1'

config forwarding
	option src 'lan'
	option dest 'transit_direct'

config zone
	option name 'transit_vpn'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option masq '1'
	option mtu_fix '1'
	list network 'transit_vpn'

config forwarding
	option src 'lan'
	option dest 'transit_vpn'

config zone
	option name 'remote_in'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	list network 'wg_remote'

config forwarding
	option src 'remote_in'
	option dest 'lan'

config forwarding
	option src 'remote_in'
	option dest 'transit_direct'

config forwarding
	option src 'remote_in'
	option dest 'transit_vpn'

config rule
	option src 'transit_direct'
	option name 'Allow-WG-Remote-In'
	list proto 'udp'
	list dest_ip '10.201.0.1'
	option dest_port '51820'
	option target 'ACCEPT'

config rule
	option name 'ALLOW_OWNER_DNS_VM100'
	option family 'ipv4'
	option src 'remote_in'
	option src_ip '10.250.1.3'
	option proto 'tcp udp'
	option dest_port '53'
	option target 'ACCEPT'

config rule
	option name 'ALLOW_OWNER_WGEASY_UI'
	option family 'ipv4'
	option src 'remote_in'
	option dest 'lan'
	option src_ip '10.250.1.3'
	option dest_ip '10.71.1.189'
	option proto 'tcp'
	option dest_port '51822'
	option target 'ACCEPT'

config rule
	option name 'BLOCK_OWNER_VM100_ROUTER'
	option family 'ipv4'
	option src 'remote_in'
	option src_ip '10.250.1.3'
	option proto 'all'
	option target 'REJECT'

config rule
	option name 'BLOCK_OWNER_VM101'
	option family 'ipv4'
	option src 'remote_in'
	option dest 'lan'
	option src_ip '10.250.1.3'
	option dest_ip '10.71.1.2'
	option proto 'all'
	option target 'REJECT'

config rule
	option name 'BLOCK_OWNER_PROXMOX'
	option family 'ipv4'
	option src 'remote_in'
	option dest 'lan'
	option src_ip '10.250.1.3'
	option dest_ip '10.71.1.222'
	option proto 'all'
	option target 'REJECT'

config rule
	option name 'BLOCK_OWNER_VM103_EXCEPT_UI'
	option family 'ipv4'
	option src 'remote_in'
	option dest 'lan'
	option src_ip '10.250.1.3'
	option dest_ip '10.71.1.189'
	option proto 'all'
	option target 'REJECT'

config zone 'wg_paid'
	option name 'wg_paid'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'REJECT'
	list network 'wg_paid'

config forwarding 'wg_paid_to_transit_direct'
	option src 'wg_paid'
	option dest 'transit_direct'

config forwarding 'wg_paid_to_transit_vpn'
	option src 'wg_paid'
	option dest 'transit_vpn'

config rule 'allow_wg_paid_51830'
	option name 'Allow-WG-Paid-51830'
	option proto 'udp'
	option dest_port '51830'
	option target 'ACCEPT'

===== FILE END: /etc/config/firewall =====

===== FILE BEGIN: /etc/config/dhcp =====

config dnsmasq
	option domainneeded '1'
	option localise_queries '1'
	option rebind_protection '1'
	option rebind_localhost '1'
	option local '/lan/'
	option domain 'lan'
	option expandhosts '1'
	option cachesize '1000'
	option authoritative '1'
	option readethers '1'
	option leasefile '/tmp/dhcp.leases'
	option localservice '1'
	option ednspacket_max '1232'
	option noresolv '1'
	list server '1.1.1.1'
	list server '8.8.8.8'
	list server '9.9.9.9'
	list addnmount '/var/run/pbr.dnsmasq'

config dhcp 'lan'
	option interface 'lan'
	option start '100'
	option limit '100'
	option leasetime '12h'
	option dhcpv4 'server'
	option dhcpv6 'disabled'
	option ra 'disabled'

config odhcpd 'odhcpd'
	option maindhcp '0'
	option leasefile '/tmp/hosts/odhcpd'
	option leasetrigger '/usr/sbin/odhcpd-update'
	option loglevel '4'

config host
	option name 'wg-guest'
	option ip '10.71.1.189'
	list mac 'BC:24:11:81:3F:F6'

config host
	option name 'vm105-control-panel'
	option mac 'bc:24:11:97:99:24'
	option ip '10.71.100.105'
	option leasetime 'infinite'

===== FILE END: /etc/config/dhcp =====

===== FILE BEGIN: /etc/pbr.d/default_lan_to_vpn.sh =====
#!/bin/sh
# Client appliance default:
# LAN + admin WireGuard + QR WireGuard use VPN as default path.
# Direct destinations are handled separately by ru_to_direct.sh.

nft add element inet fw4 pbr_transit_vpn_4_src_ip_user "{ 10.71.100.0/24, 10.250.100.0/24, 10.252.100.0/24, 10.253.0.0/16 }" 2>/dev/null || true
===== FILE END: /etc/pbr.d/default_lan_to_vpn.sh =====

===== FILE BEGIN: /etc/pbr.d/ru_to_direct.sh =====
#!/bin/sh

SET="pbr_transit_direct_4_dst_ip_user"
FILE="/root/ru.zone"

[ -r "$FILE" ] || exit 0
nft list set inet fw4 "$SET" >/dev/null 2>&1 || exit 0

nft flush set inet fw4 "$SET" 2>/dev/null

while read -r cidr; do
    case "$cidr" in
        ""|\#*) continue ;;
    esac
    nft add element inet fw4 "$SET" "{ $cidr }"
done < "$FILE"
===== FILE END: /etc/pbr.d/ru_to_direct.sh =====

===== FILE BEGIN: /etc/hotplug.d/iface/99-pbr-delayed-restart =====
#!/bin/sh

# Restart PBR after VM100 transit interfaces are really up.
# Needed because PBR may start too early during boot.

[ "$ACTION" = "ifup" ] || [ "$ACTION" = "ifupdate" ] || exit 0

case "$INTERFACE" in
    transit_direct|transit_vpn|lan)
        ;;
    *)
        exit 0
        ;;
esac

LOCK="/tmp/pbr-delayed-restart.lock"

mkdir "$LOCK" 2>/dev/null || exit 0

(
    logger -t pbr-delay "scheduled after $INTERFACE $ACTION"

    # Wait until both transit routes/gateways are visible.
    for i in $(seq 1 30); do
        ip route | grep -q "10.201.0.2" && \
        ip route | grep -q "10.200.0.2" && break
        sleep 2
    done

    # Small extra delay for firewall/fw4 to settle.
    sleep 5

    /etc/init.d/pbr restart

    logger -t pbr-delay "pbr restarted after network readiness check"

    rmdir "$LOCK" 2>/dev/null
) &

exit 0
===== FILE END: /etc/hotplug.d/iface/99-pbr-delayed-restart =====

===== FILE BEGIN: /etc/init.d/router-egress-activity =====
#!/bin/sh /etc/rc.common

START=97
STOP=10
USE_PROCD=1

start_service() {
    /usr/local/sbin/router-egress-activity-apply.sh
    procd_open_instance
    procd_set_param command /bin/sh -c 'sleep 3600'
    procd_set_param respawn 3600 5 0
    procd_close_instance
}

reload_service() {
    /usr/local/sbin/router-egress-activity-apply.sh
}

stop_service() {
    nft delete table inet router_egress_activity 2>/dev/null || true
}
===== FILE END: /etc/init.d/router-egress-activity =====

===== FILE BEGIN: /etc/init.d/router-wgpay-canary =====
#!/bin/sh /etc/rc.common

START=99
STOP=10

start() {
  /usr/local/sbin/router-wgpay-canary-apply.sh start
}

stop() {
  /usr/local/sbin/router-wgpay-canary-apply.sh stop
}

restart() {
  stop
  start
}

reload_service() {
  start
}
===== FILE END: /etc/init.d/router-wgpay-canary =====

===== FILE BEGIN: /etc/init.d/router-wgpay-egress-local =====
#!/bin/sh /etc/rc.common

START=99
STOP=10
USE_PROCD=1

PROG="/usr/local/sbin/router-wgpay-egress-local-loop.sh"

start_service() {
  procd_open_instance
  procd_set_param command "$PROG"
  procd_set_param respawn 3600 5 5
  procd_set_param stdout 0
  procd_set_param stderr 0
  procd_close_instance
}

stop_service() {
  return 0
}
===== FILE END: /etc/init.d/router-wgpay-egress-local =====

===== FILE BEGIN: /usr/local/sbin/router-egress-activity-apply.sh =====
#!/bin/sh
set -eu
TABLE_FILE="/etc/router-egress-activity/router_egress_activity.nft"
if [ ! -s "$TABLE_FILE" ]; then
  echo "missing or empty $TABLE_FILE" >&2
  exit 1
fi
nft delete table inet router_egress_activity 2>/dev/null || true
nft -f "$TABLE_FILE"
nft list table inet router_egress_activity >/dev/null
===== FILE END: /usr/local/sbin/router-egress-activity-apply.sh =====

===== FILE BEGIN: /usr/local/sbin/router-egress-activity-read.sh =====
#!/bin/sh
set -eu
nft list counters table inet router_egress_activity 2>/dev/null || nft list table inet router_egress_activity
===== FILE END: /usr/local/sbin/router-egress-activity-read.sh =====

===== FILE BEGIN: /usr/local/sbin/router-wgpay-canary-apply.sh =====
#!/bin/sh
set -u

SEL_FILE="/etc/router-wgpay-selector.d/peers.conf"
TABLE="wgpay_dscp_canary"

apply_rules() {
  [ -f "$SEL_FILE" ] || {
    echo "BLOCK: selector_file_missing"
    exit 2
  }

  nft delete table inet "$TABLE" 2>/dev/null || true
  nft add table inet "$TABLE"
  nft add chain inet "$TABLE" prerouting '{ type filter hook prerouting priority mangle; policy accept; }'

  count=0

  while read ip dscp comment rest; do
    case "${ip:-}" in
      ""|\#*) continue ;;
    esac

    case "${dscp:-}" in
      cs1|cs2|cs3|cs4|cs5|cs6|cs7|ef|af11|af12|af13|af21|af22|af23|af31|af32|af33|af41|af42|af43|be) ;;
      *)
        echo "BLOCK: unsupported_dscp_for_$ip=$dscp"
        exit 3
        ;;
    esac

    echo "$ip" | grep -E '^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$' >/dev/null || {
      echo "BLOCK: invalid_ip=$ip"
      exit 4
    }

    wg show wg_paid dump 2>/dev/null | grep -F "$ip/32" >/dev/null || {
      echo "BLOCK: selector_ip_not_in_wg_paid=$ip"
      exit 5
    }

    safe_comment="$(echo "${comment:-selector}" | tr -cd 'A-Za-z0-9_.:-' | cut -c1-40)"
    [ -n "$safe_comment" ] || safe_comment="selector"

    nft add rule inet "$TABLE" prerouting iifname "wg_paid" ip saddr "$ip" ip dscp set "$dscp" counter comment "STEP_035B_SELECTOR_WGPAY_${safe_comment}_${ip}_${dscp}"
    count=$((count + 1))
  done < "$SEL_FILE"

  [ "$count" -gt 0 ] || {
    echo "BLOCK: selector_file_no_active_entries"
    exit 6
  }

  echo "applied_vm100_wgpay_selector_rules=$count"
}

case "${1:-start}" in
  start|restart|reload)
    apply_rules
    ;;

  stop)
    nft delete table inet "$TABLE" 2>/dev/null || true
    echo "stopped_vm100_wgpay_selector=1"
    ;;

  status)
    nft list table inet "$TABLE" 2>/dev/null
    ;;

  *)
    echo "usage: $0 {start|stop|restart|reload|status}"
    exit 1
    ;;
esac
===== FILE END: /usr/local/sbin/router-wgpay-canary-apply.sh =====

===== FILE BEGIN: /usr/local/sbin/router-wgpay-egress-local-loop.sh =====
#!/bin/sh
set -u

CONF="${ROUTER_EGRESS_LOCAL_CONF:-/etc/router-wgpay-egress-local.conf}"

MODE="--dry-run"
INTERVAL="30"
LOG="/var/log/router-wgpay-egress-local.log"
SCRIPT="/usr/local/sbin/router-wgpay-egress-local.sh"

ROUTER_EGRESS_ALLOCATOR_ENABLED="1"
ROUTER_EGRESS_REBALANCE_PAUSED="0"
ROUTER_EGRESS_FORCE_MODE="off"
ROUTER_EGRESS_FORCE_CLASS=""
ROUTER_EGRESS_FORCE_TARGET_ID=""
ROUTER_EGRESS_FORCE_REASON=""
ROUTER_EGRESS_FORCE_UNTIL=""
ROUTER_EGRESS_ACTIVE_MIN_PACKETS="10"
ROUTER_EGRESS_ACTIVE_MIN_BYTES="16384"

if [ -f "$CONF" ]; then
  # shellcheck disable=SC1090
  . "$CONF"
fi

: "${MODE:=--dry-run}"
: "${INTERVAL:=30}"
: "${LOG:=/var/log/router-wgpay-egress-local.log}"
: "${SCRIPT:=/usr/local/sbin/router-wgpay-egress-local.sh}"

export ROUTER_EGRESS_ALLOCATOR_ENABLED
export ROUTER_EGRESS_REBALANCE_PAUSED
export ROUTER_EGRESS_FORCE_MODE
export ROUTER_EGRESS_FORCE_CLASS
export ROUTER_EGRESS_FORCE_TARGET_ID
export ROUTER_EGRESS_FORCE_REASON
export ROUTER_EGRESS_FORCE_UNTIL
export ROUTER_EGRESS_ACTIVE_MIN_PACKETS
export ROUTER_EGRESS_ACTIVE_MIN_BYTES

mkdir -p "$(dirname "$LOG")" 2>/dev/null || true

echo "__ROUTER_WGPAY_EGRESS_LOCAL_LOOP_BEGIN__ pid=$$ conf=$CONF mode=$MODE interval=$INTERVAL allocator_enabled=$ROUTER_EGRESS_ALLOCATOR_ENABLED paused=$ROUTER_EGRESS_REBALANCE_PAUSED force_mode=$ROUTER_EGRESS_FORCE_MODE started_at=$(date -Is 2>/dev/null || date)" >> "$LOG"

while true; do
  {
    echo "__ROUTER_WGPAY_EGRESS_LOCAL_RUN_BEGIN__"
    echo "run_started_at=$(date -Is 2>/dev/null || date)"
    echo "conf=$CONF"
    echo "mode=$MODE"
    echo "script=$SCRIPT"
    echo "allocator_enabled=$ROUTER_EGRESS_ALLOCATOR_ENABLED"
    echo "rebalance_paused=$ROUTER_EGRESS_REBALANCE_PAUSED"
    echo "force_mode=$ROUTER_EGRESS_FORCE_MODE"
    "$SCRIPT" "$MODE"
    rc=$?
    echo "run_rc=$rc"
    echo "run_finished_at=$(date -Is 2>/dev/null || date)"
    echo "__ROUTER_WGPAY_EGRESS_LOCAL_RUN_END__"
  } >> "$LOG" 2>&1

  sleep "$INTERVAL"
done
===== FILE END: /usr/local/sbin/router-wgpay-egress-local-loop.sh =====

===== FILE BEGIN: /usr/local/sbin/router-wgpay-egress-local.sh =====
#!/bin/sh
set -u

MODE="${1:---dry-run}"
SEL="${ROUTER_EGRESS_SELECTOR_FILE:-/etc/router-wgpay-selector.d/peers.conf}"
APPLY="${ROUTER_EGRESS_SELECTOR_APPLY:-/usr/local/sbin/router-wgpay-canary-apply.sh}"
STATE_DIR="${ROUTER_EGRESS_STATE_DIR:-/var/lib/router-wgpay-egress}"
STATE_FILE="${ROUTER_EGRESS_STATE_FILE:-${STATE_DIR}/state.kv}"
SYN_ACTIVE_IPS="$(echo "${ROUTER_EGRESS_SYNTHETIC_ACTIVE_IPS:-}" | tr ',' ' ')"

ACTIVE_MIN_PACKETS="${ROUTER_EGRESS_ACTIVE_MIN_PACKETS:-10}"
ACTIVE_MIN_BYTES="${ROUTER_EGRESS_ACTIVE_MIN_BYTES:-16384}"
IDLE_SECONDS="${ROUTER_EGRESS_IDLE_SECONDS:-900}"
REASSIGN_COOLDOWN_SECONDS="${ROUTER_EGRESS_REASSIGN_COOLDOWN_SECONDS:-900}"

ALLOCATOR_ENABLED="${ROUTER_EGRESS_ALLOCATOR_ENABLED:-1}"
REBALANCE_PAUSED="${ROUTER_EGRESS_REBALANCE_PAUSED:-0}"
FORCE_MODE="${ROUTER_EGRESS_FORCE_MODE:-off}"

CLASSES="cs1 cs2 cs3 cs4 cs5"
NOW="$(date +%s)"

target_for_class() {
  case "$1" in
    cs1) echo "canary_vpn3" ;;
    cs2) echo "canary_vpn4" ;;
    cs3) echo "canary_vpn5" ;;
    cs4) echo "canary_vpn1" ;;
    cs5) echo "canary_vpn2" ;;
    *) echo "" ;;
  esac
}

state_get() {
  key="$1"
  [ -f "$STATE_FILE" ] || { echo ""; return 0; }
  grep -E "^${key}=" "$STATE_FILE" 2>/dev/null | tail -1 | sed 's/^[^=]*=//' || true
}

counter_snapshot() {
  ip="$1"
  safe_ip="$(echo "$ip" | tr '.' '_')"
  nft list table inet router_egress_activity 2>/dev/null | awk -v safe="$safe_ip" '
    BEGIN {op=0; ob=0; ipk=0; ib=0}
    $0 ~ "peer_" safe "_out_vpn" {
      for (i=1; i<=NF; i++) {
        if ($i=="packets") op=$(i+1)
        if ($i=="bytes") ob=$(i+1)
      }
    }
    $0 ~ "peer_" safe "_in_vpn" {
      for (i=1; i<=NF; i++) {
        if ($i=="packets") ipk=$(i+1)
        if ($i=="bytes") ib=$(i+1)
      }
    }
    END {print op, ob, ipk, ib}
  '
}

is_synthetic_active() {
  ip="$1"
  for a in $SYN_ACTIVE_IPS; do
    [ "$a" = "$ip" ] && return 0
  done
  return 1
}

safe_delta() {
  cur="$1"
  prev="$2"
  [ -n "$prev" ] || prev=0
  if [ "$cur" -ge "$prev" ] 2>/dev/null; then
    echo $((cur - prev))
  else
    echo "$cur"
  fi
}

if [ "$MODE" != "--dry-run" ] && [ "$MODE" != "--apply-preview" ] && [ "$MODE" != "--state-preview" ] && [ "$MODE" != "--state-write" ] && [ "$MODE" != "--commit" ]; then
  echo "Usage: $0 --dry-run|--apply-preview|--state-preview|--state-write|--commit" >&2
  exit 64
fi

TMP="/tmp/router-wgpay-egress-local-rows.$$"
STATE_TMP="/tmp/router-wgpay-egress-local-state.$$"
SEL_TMP="/tmp/router-wgpay-egress-local-selector.$$"
APPLY_LOG="/tmp/router-wgpay-egress-local-apply.$$.log"
trap 'rm -f "$TMP" "$STATE_TMP" "$SEL_TMP" "$APPLY_LOG" "${STATE_FILE}.tmp.$$"' EXIT
: > "$TMP"

grep -Ev '^[[:space:]]*(#|$)' "$SEL" 2>/dev/null | while read -r ip cls tag rest; do
  [ -n "$ip" ] || continue

  vals="$(counter_snapshot "$ip")"
  set -- $vals
  outp="${1:-0}"
  outb="${2:-0}"
  inp="${3:-0}"
  inb="${4:-0}"

  prev_outp="$(state_get "peer.${ip}.out_packets")"
  prev_outb="$(state_get "peer.${ip}.out_bytes")"
  prev_inp="$(state_get "peer.${ip}.in_packets")"
  prev_inb="$(state_get "peer.${ip}.in_bytes")"
  prev_last_active="$(state_get "peer.${ip}.last_active_epoch")"
  prev_last_reassign="$(state_get "peer.${ip}.last_reassign_epoch")"

  [ -n "$prev_last_active" ] || prev_last_active=0
  [ -n "$prev_last_reassign" ] || prev_last_reassign=0

  delta_outp="$(safe_delta "$outp" "$prev_outp")"
  delta_outb="$(safe_delta "$outb" "$prev_outb")"
  delta_inp="$(safe_delta "$inp" "$prev_inp")"
  delta_inb="$(safe_delta "$inb" "$prev_inb")"
  delta_packets=$((delta_outp + delta_inp))
  delta_bytes=$((delta_outb + delta_inb))

  active_now=false
  active_state=false
  last_active="$prev_last_active"

  if is_synthetic_active "$ip"; then
    active_now=true
  elif [ "$delta_packets" -ge "$ACTIVE_MIN_PACKETS" ] || [ "$delta_bytes" -ge "$ACTIVE_MIN_BYTES" ]; then
    active_now=true
  fi

  if [ "$active_now" = "true" ]; then
    last_active="$NOW"
    active_state=true
  elif [ "$prev_last_active" -gt 0 ] 2>/dev/null && [ $((NOW - prev_last_active)) -lt "$IDLE_SECONDS" ]; then
    active_state=true
  fi

  cooldown_ok=true
  if [ "$prev_last_reassign" -gt 0 ] 2>/dev/null && [ $((NOW - prev_last_reassign)) -lt "$REASSIGN_COOLDOWN_SECONDS" ]; then
    cooldown_ok=false
  fi

  printf '%s %s %s %s %s %s %s %s %s %s %s %s %s %s\n' \
    "$ip" "$cls" "$tag" "$active_now" "$active_state" "$cooldown_ok" \
    "$outp" "$outb" "$inp" "$inb" "$delta_packets" "$delta_bytes" "$last_active" "$prev_last_reassign" >> "$TMP"
done

blocked=false
block_reason=""
if [ "$ALLOCATOR_ENABLED" != "1" ]; then
  blocked=true
  block_reason="allocator_disabled"
elif [ "$FORCE_MODE" != "off" ]; then
  blocked=true
  block_reason="force_mode_active"
elif [ "$REBALANCE_PAUSED" != "0" ]; then
  blocked=true
  block_reason="rebalance_paused"
fi

rows="$(wc -l < "$TMP" | tr -d ' ')"
active_now_count="$(awk '$4=="true"{c++} END{print c+0}' "$TMP")"
active_state_count="$(awk '$5=="true"{c++} END{print c+0}' "$TMP")"
idle_count="$(awk '$5!="true"{c++} END{print c+0}' "$TMP")"

min_class=""
max_class=""
min_count=999
max_count=-1

for cls in $CLASSES; do
  c="$(awk -v cls="$cls" '$2==cls{n++} END{print n+0}' "$TMP")"
  if [ "$c" -lt "$min_count" ]; then
    min_count="$c"
    min_class="$cls"
  fi
  if [ "$c" -gt "$max_count" ]; then
    max_count="$c"
    max_class="$cls"
  fi
done

action_count=0
action_ip=""
action_from_class=""
action_from_target=""
action_to_class=""
action_to_target=""
action_reason=""

if [ "$blocked" = "false" ]; then
  diff=$((max_count - min_count))
  if [ "$diff" -gt 1 ]; then
    movable="$(awk -v cls="$max_class" '$2==cls && $5!="true" && $6=="true"{print; exit}' "$TMP")"
    if [ -n "$movable" ]; then
      set -- $movable
      action_ip="$1"
      action_from_class="$2"
      action_from_target="$3"
      action_to_class="$min_class"
      action_to_target="$(target_for_class "$min_class")"
      action_reason="idle_state_rebalance_most_loaded_to_least_loaded"
      action_count=1
    else
      action_reason="no_idle_cooldown_ok_peer_on_most_loaded_class"
    fi
  else
    action_reason="already_balanced"
  fi
else
  action_reason="$block_reason"
fi

noop=true
[ "$action_count" -gt 0 ] && noop=false

selector_would_change=false
selector_apply_would_run=false
state_file_would_write=false
if [ "$MODE" = "--state-write" ] || [ "$MODE" = "--commit" ]; then
  state_file_would_write=true
fi
if [ "$MODE" = "--apply-preview" ] || [ "$MODE" = "--state-preview" ] || [ "$MODE" = "--state-write" ] || [ "$MODE" = "--commit" ]; then
  if [ "$action_count" -gt 0 ]; then
    selector_would_change=true
    selector_apply_would_run=true
  fi
fi

{
  echo "schema=router-wgpay-egress-local-state-v2"
  echo "generated_epoch=$NOW"
  echo "selector_file=$SEL"
  echo "state_file=$STATE_FILE"
  echo "mode=$MODE"
  echo "rows=$rows"
  echo "active_now_count=$active_now_count"
  echo "active_state_count=$active_state_count"
  echo "idle_count=$idle_count"
  echo "idle_seconds=$IDLE_SECONDS"
  echo "reassign_cooldown_seconds=$REASSIGN_COOLDOWN_SECONDS"
  echo "active_min_packets=$ACTIVE_MIN_PACKETS"
  echo "active_min_bytes=$ACTIVE_MIN_BYTES"
  echo "min_class=$min_class"
  echo "min_count=$min_count"
  echo "max_class=$max_class"
  echo "max_count=$max_count"
  echo "blocked=$blocked"
  echo "block_reason=$block_reason"
  echo "action_count=$action_count"
  echo "action_ip=$action_ip"
  echo "action_from_class=$action_from_class"
  echo "action_from_target=$action_from_target"
  echo "action_to_class=$action_to_class"
  echo "action_to_target=$action_to_target"
  echo "action_reason=$action_reason"
  echo "selector_would_change=$selector_would_change"
  echo "selector_apply_would_run=$selector_apply_would_run"
  echo "state_file_would_write=$state_file_would_write"

  while read -r ip cls tag active_now active_state cooldown_ok outp outb inp inb delta_packets delta_bytes last_active last_reassign; do
    next_last_reassign="$last_reassign"
    if [ "$action_count" -gt 0 ] && [ "$ip" = "$action_ip" ]; then
      next_last_reassign="$NOW"
    fi
    echo "peer.${ip}.class=$cls"
    echo "peer.${ip}.target=$tag"
    echo "peer.${ip}.active_now=$active_now"
    echo "peer.${ip}.active_state=$active_state"
    echo "peer.${ip}.cooldown_ok=$cooldown_ok"
    echo "peer.${ip}.out_packets=$outp"
    echo "peer.${ip}.out_bytes=$outb"
    echo "peer.${ip}.in_packets=$inp"
    echo "peer.${ip}.in_bytes=$inb"
    echo "peer.${ip}.delta_packets=$delta_packets"
    echo "peer.${ip}.delta_bytes=$delta_bytes"
    echo "peer.${ip}.last_active_epoch=$last_active"
    echo "peer.${ip}.last_reassign_epoch=$next_last_reassign"
  done < "$TMP"
} > "$STATE_TMP"

state_preview_sha="$(sha256sum "$STATE_TMP" | awk '{print $1}')"

selector_update_performed=false
selector_update_rc="not_attempted"
selector_apply_performed=false
selector_apply_rc="not_attempted"
selector_new_sha=""
state_file_write_performed=false
state_file_write_rc="not_attempted"
commit_rc=0

if [ "$MODE" = "--state-write" ]; then
  mkdir -p "$STATE_DIR"
  cp "$STATE_TMP" "${STATE_FILE}.tmp.$$" && mv "${STATE_FILE}.tmp.$$" "$STATE_FILE"
  state_file_write_rc=$?
  [ "$state_file_write_rc" = "0" ] && state_file_write_performed=true
  [ "$state_file_write_rc" = "0" ] || commit_rc="$state_file_write_rc"
fi

if [ "$MODE" = "--commit" ]; then
  if [ "$action_count" -gt 0 ]; then
    awk -v ip="$action_ip" -v cls="$action_to_class" -v tag="$action_to_target" '
      $1 == ip { print ip " " cls " " tag; changed=1; next }
      { print }
      END { if (changed != 1) exit 42 }
    ' "$SEL" > "$SEL_TMP"
    selector_update_rc=$?

    if [ "$selector_update_rc" = "0" ]; then
      selector_new_sha="$(sha256sum "$SEL_TMP" | awk '{print $1}')"
      mv "$SEL_TMP" "$SEL"
      selector_update_rc=$?
      [ "$selector_update_rc" = "0" ] && selector_update_performed=true
    fi

    if [ "$selector_update_rc" = "0" ] && [ -x "$APPLY" ]; then
      "$APPLY" start > "$APPLY_LOG" 2>&1
      selector_apply_rc=$?
      selector_apply_performed=true
    else
      [ -x "$APPLY" ] || selector_apply_rc="apply_script_missing"
    fi
  else
    selector_update_rc="noop"
    selector_apply_rc="noop"
  fi

  if [ "$action_count" = "0" ] || { [ "$selector_update_rc" = "0" ] && [ "$selector_apply_rc" = "0" ]; }; then
    mkdir -p "$STATE_DIR"
    cp "$STATE_TMP" "${STATE_FILE}.tmp.$$" && mv "${STATE_FILE}.tmp.$$" "$STATE_FILE"
    state_file_write_rc=$?
    [ "$state_file_write_rc" = "0" ] && state_file_write_performed=true
  fi

  if [ "$action_count" -gt 0 ]; then
    if [ "$selector_update_rc" != "0" ]; then
      commit_rc="$selector_update_rc"
    elif [ "$selector_apply_rc" != "0" ]; then
      commit_rc=70
    elif [ "$state_file_write_rc" != "0" ]; then
      commit_rc="$state_file_write_rc"
    fi
  elif [ "$state_file_write_rc" != "0" ]; then
    commit_rc="$state_file_write_rc"
  fi
fi

apply_log_sanitized="$(cat "$APPLY_LOG" 2>/dev/null | sed 's/[A-Za-z0-9+\/=]\{20,\}/KEYMASK/g' | tr '\n' '|')"

echo "{"
echo '  "schema": "router-wgpay-egress-local-v7",'
echo "  \"mode\": \"$MODE\","
echo "  \"now_epoch\": $NOW,"
echo "  \"selector_file\": \"$SEL\","
echo "  \"selector_apply\": \"$APPLY\","
echo "  \"state_file\": \"$STATE_FILE\","
echo "  \"idle_seconds\": $IDLE_SECONDS,"
echo "  \"reassign_cooldown_seconds\": $REASSIGN_COOLDOWN_SECONDS,"
echo '  "rows": ['

first=1
while read -r ip cls tag active_now active_state cooldown_ok outp outb inp inb delta_packets delta_bytes last_active last_reassign; do
  expected="$(target_for_class "$cls")"
  match=false
  [ "$tag" = "$expected" ] && match=true

  [ "$first" = "0" ] && echo ","
  first=0
  printf '    {"tunnel_ip":"%s","egress_class":"%s","target_id":"%s","expected_target_id":"%s","selector_target_match":%s,"active_now":%s,"active_state":%s,"cooldown_ok":%s,"out_packets":%s,"in_packets":%s,"delta_packets":%s,"delta_bytes":%s,"last_active_epoch":%s,"last_reassign_epoch":%s}' \
    "$ip" "$cls" "$tag" "$expected" "$match" "$active_now" "$active_state" "$cooldown_ok" "$outp" "$inp" "$delta_packets" "$delta_bytes" "$last_active" "$last_reassign"
done < "$TMP"

echo
echo "  ],"
echo '  "actions": ['
if [ "$action_count" -gt 0 ]; then
  printf '    {"tunnel_ip":"%s","from_class":"%s","from_target_id":"%s","to_class":"%s","to_target_id":"%s","reason":"%s"}\n' \
    "$action_ip" "$action_from_class" "$action_from_target" "$action_to_class" "$action_to_target" "$action_reason"
fi
echo "  ],"
echo '  "commit": {'
echo "    \"commit_rc\": \"$commit_rc\","
echo "    \"selector_update_performed\": $selector_update_performed,"
echo "    \"selector_update_rc\": \"$selector_update_rc\","
echo "    \"selector_apply_performed\": $selector_apply_performed,"
echo "    \"selector_apply_rc\": \"$selector_apply_rc\","
echo "    \"selector_new_sha256\": \"$selector_new_sha\","
echo "    \"state_file_write_performed\": $state_file_write_performed,"
echo "    \"state_file_write_rc\": \"$state_file_write_rc\","
echo "    \"apply_log_sanitized\": \"$apply_log_sanitized\""
echo "  },"
echo '  "state_preview": {'
echo "    \"state_file\": \"$STATE_FILE\","
echo "    \"would_write_state_file\": $state_file_would_write,"
echo "    \"state_file_write_performed\": $state_file_write_performed,"
echo "    \"state_file_write_rc\": \"$state_file_write_rc\","
echo "    \"state_preview_sha256\": \"$state_preview_sha\","
echo '    "format": "key_value_v2"'
echo "  },"
echo '  "summary": {'
echo "    \"rows\": $rows,"
echo "    \"active_now_count\": $active_now_count,"
echo "    \"active_state_count\": $active_state_count,"
echo "    \"idle_count\": $idle_count,"
echo "    \"min_class\": \"$min_class\","
echo "    \"min_count\": $min_count,"
echo "    \"max_class\": \"$max_class\","
echo "    \"max_count\": $max_count,"
echo "    \"blocked\": $blocked,"
echo "    \"block_reason\": \"$block_reason\","
echo "    \"action_count\": $action_count,"
echo "    \"noop\": $noop,"
echo "    \"action_reason\": \"$action_reason\","
echo "    \"selector_file_would_change\": $selector_would_change,"
echo "    \"selector_apply_would_run\": $selector_apply_would_run,"
echo "    \"state_file_would_write\": $state_file_would_write"
echo '  }'
echo "}"

exit "$commit_rc"
===== FILE END: /usr/local/sbin/router-wgpay-egress-local.sh =====

===== FILE BEGIN: /etc/router-egress-activity/router_egress_activity.nft =====
# Generated by STEP_044H5. Managed file; do not edit manually.
table inet router_egress_activity {
    counter peer_10_253_1_10_out_vpn { }
    counter peer_10_253_1_10_in_vpn { }
    counter peer_10_253_1_11_out_vpn { }
    counter peer_10_253_1_11_in_vpn { }
    counter peer_10_253_1_12_out_vpn { }
    counter peer_10_253_1_12_in_vpn { }
    counter peer_10_253_1_13_out_vpn { }
    counter peer_10_253_1_13_in_vpn { }
    counter peer_10_253_1_14_out_vpn { }
    counter peer_10_253_1_14_in_vpn { }

    chain forward_activity {
        type filter hook forward priority 0; policy accept;
        iifname "wg_paid" oifname "eth2" ip saddr 10.253.1.10/32 counter name peer_10_253_1_10_out_vpn comment "activity_out 10.253.1.10/32 cs1 cs1_vpn3"
        iifname "eth2" oifname "wg_paid" ip daddr 10.253.1.10/32 counter name peer_10_253_1_10_in_vpn comment "activity_in 10.253.1.10/32 cs1 cs1_vpn3"
        iifname "wg_paid" oifname "eth2" ip saddr 10.253.1.11/32 counter name peer_10_253_1_11_out_vpn comment "activity_out 10.253.1.11/32 cs2 cs2_vpn4"
        iifname "eth2" oifname "wg_paid" ip daddr 10.253.1.11/32 counter name peer_10_253_1_11_in_vpn comment "activity_in 10.253.1.11/32 cs2 cs2_vpn4"
        iifname "wg_paid" oifname "eth2" ip saddr 10.253.1.12/32 counter name peer_10_253_1_12_out_vpn comment "activity_out 10.253.1.12/32 cs3 cs3_vpn5"
        iifname "eth2" oifname "wg_paid" ip daddr 10.253.1.12/32 counter name peer_10_253_1_12_in_vpn comment "activity_in 10.253.1.12/32 cs3 cs3_vpn5"
        iifname "wg_paid" oifname "eth2" ip saddr 10.253.1.13/32 counter name peer_10_253_1_13_out_vpn comment "activity_out 10.253.1.13/32 cs4 cs4_vpn1"
        iifname "eth2" oifname "wg_paid" ip daddr 10.253.1.13/32 counter name peer_10_253_1_13_in_vpn comment "activity_in 10.253.1.13/32 cs4 cs4_vpn1"
        iifname "wg_paid" oifname "eth2" ip saddr 10.253.1.14/32 counter name peer_10_253_1_14_out_vpn comment "activity_out 10.253.1.14/32 cs5 cs5_vpn2"
        iifname "eth2" oifname "wg_paid" ip daddr 10.253.1.14/32 counter name peer_10_253_1_14_in_vpn comment "activity_in 10.253.1.14/32 cs5 cs5_vpn2"
    }
}
===== FILE END: /etc/router-egress-activity/router_egress_activity.nft =====

===== FILE BEGIN: /etc/router-wgpay-egress-local.conf =====
MODE=--commit
INTERVAL=60
LOG=/var/log/router-wgpay-egress-local.log
SCRIPT=/usr/local/sbin/router-wgpay-egress-local.sh

ROUTER_EGRESS_ALLOCATOR_ENABLED=1
ROUTER_EGRESS_REBALANCE_PAUSED=0
ROUTER_EGRESS_FORCE_MODE=off
ROUTER_EGRESS_FORCE_CLASS=
ROUTER_EGRESS_FORCE_TARGET_ID=
ROUTER_EGRESS_FORCE_REASON=
ROUTER_EGRESS_FORCE_UNTIL=
ROUTER_EGRESS_ACTIVE_MIN_PACKETS=10
ROUTER_EGRESS_ACTIVE_MIN_BYTES=16384
ROUTER_EGRESS_IDLE_SECONDS=900
ROUTER_EGRESS_REASSIGN_COOLDOWN_SECONDS=900
===== FILE END: /etc/router-wgpay-egress-local.conf =====

===== FILE BEGIN: /etc/nftables.d/10-custom-filter-chains.nft =====
## The firewall4 input, forward and output chains are registered with
## priority `filter` (0).


## Uncomment the chains below if you want to stage rules *before* the
## default firewall input, forward and output chains.

# chain user_pre_input {
#     type filter hook input priority -1; policy accept;
#     tcp dport ssh ct state new log prefix "SSH connection attempt: "
# }
#
# chain user_pre_forward {
#     type filter hook forward priority -1; policy accept;
# }
#
# chain user_pre_output {
#     type filter hook output priority -1; policy accept;
# }


## Uncomment the chains below if you want to stage rules *after* the
## default firewall input, forward and output chains.

# chain user_post_input {
#     type filter hook input priority 1; policy accept;
#     ct state new log prefix "Firewall4 accepted ingress: "
# }
#
# chain user_post_forward {
#     type filter hook forward priority 1; policy accept;
#     ct state new log prefix "Firewall4 accepted forward: "
# }
#
# chain user_post_output {
#     type filter hook output priority 1; policy accept;
#     ct state new log prefix "Firewall4 accepted egress: "
# }

===== FILE END: /etc/nftables.d/10-custom-filter-chains.nft =====

===== FILE BEGIN: /etc/nftables.d/90-wg-remote-snat-to-pc.nft =====
chain wg_remote_snat_to_pc {
    type nat hook postrouting priority 99; policy accept;

    ip saddr 10.250.0.0/24 ip daddr 192.168.30.64 oifname "br-lan" counter snat ip to 192.168.30.1 comment "wg_remote_to_pc64_snat"
}
===== FILE END: /etc/nftables.d/90-wg-remote-snat-to-pc.nft =====

===== FILE BEGIN: /etc/rc.local =====
# Put your custom commands here that should be executed once
# the system init finished. By default this file does nothing.

exit 0
===== FILE END: /etc/rc.local =====

>>> [05] Absolute-path dependencies referenced by candidates
EXISTING_DEPENDENCY path=/etc/init.d/pbr size=129662 sha256=0aa794b866970a51063861879c0a45f0406e75a872394f270f63caace920e51e
EXISTING_DEPENDENCY path=/etc/rc.common size=3522 sha256=dd8ae95c78d10cccf78cb487874f163ace4c1ee14dace05fe28393b19ba639e4
EXISTING_DEPENDENCY path=/etc/router-egress-activity/router_egress_activity.nft size=2132 sha256=78240f39d95d3319e2cc5db1ea33c3bf4181853efede8cce04118ae048142b8a
EXISTING_DEPENDENCY path=/etc/router-wgpay-egress-local.conf size=479 sha256=90797d54fbb0bd46388b54ef81fd578f86377aa7a202698f0767bb413e432557
EXISTING_DEPENDENCY path=/etc/router-wgpay-selector.d/peers.conf size=315 sha256=2db1a0c46c1b93d9ede5f560d2d00db2dad3283adbc8f6ca6b0434ab695d8460
EXISTING_DEPENDENCY path=/root/ru.zone size=219728 sha256=f7b57c319d65b4d2284e01dbfd2c4d32853c65139d108ff35e2578ae1da8704f
RUNTIME_DEPENDENCY=/tmp/dhcp.leases
RUNTIME_DEPENDENCY=/tmp/hosts/odhcpd
RUNTIME_DEPENDENCY=/tmp/pbr-delayed-restart.lock
RUNTIME_DEPENDENCY=/tmp/router-wgpay-egress-local-apply.
RUNTIME_DEPENDENCY=/tmp/router-wgpay-egress-local-rows.
RUNTIME_DEPENDENCY=/tmp/router-wgpay-egress-local-selector.
RUNTIME_DEPENDENCY=/tmp/router-wgpay-egress-local-state.
EXISTING_DEPENDENCY path=/usr/local/sbin/router-egress-activity-apply.sh size=312 sha256=2625c5c22d5b72557b413e61501e70ffb65ed4ead2fddb2c3a60f224c18c7574
EXISTING_DEPENDENCY path=/usr/local/sbin/router-wgpay-canary-apply.sh size=1826 sha256=00c06f11ce4143834043e480fc1c28f26afee22fe1f313670546bd5dd71aee69
EXISTING_DEPENDENCY path=/usr/local/sbin/router-wgpay-egress-local-loop.sh size=1975 sha256=8870b71a6c87b00f4ba20f76a5b39efb5ed15e0e482fc5f7ca7d499b30cc3010
EXISTING_DEPENDENCY path=/usr/local/sbin/router-wgpay-egress-local.sh size=14236 sha256=f9432a39be5555dad13132eb5f089f7b638956027c9c060e98de29743bc7d88a
EXISTING_DEPENDENCY path=/usr/sbin/odhcpd-update size=120 sha256=7f76f012b05a8b26ef4b742786f17f5e96169c06572138a36f1b8b774c695033
EXISTING_DEPENDENCY_NONFILE=/var/lib/router-wgpay-egress
RUNTIME_DEPENDENCY=/var/log/router-wgpay-egress-local.log
RUNTIME_DEPENDENCY=/var/run/pbr.dnsmasq

>>> [06] Explicit exclusion proof
EXCLUDED_PATH_PRESENT=/root/mgts-wg-remote-keys
EXCLUDED_PATH_PRESENT=/root/router-ops-backups
EXCLUDED_PATH_PRESENT=/root/rollbacks
EXCLUDED_FILE_PRESENT=/root/rollback-agent-selector-apply.sh
EXCLUDED_FILE_PRESENT=/root/rollback-step034i-dscp-canary.sh
EXCLUDED_FILE_PRESENT=/root/rollback-step034m2-persistent-canary-vm100.sh
EXCLUDED_FILE_PRESENT=/root/rollback-step035b-vm100-selector-file.sh
EXCLUDED_FILE_PRESENT=/root/rollback-step037b-cs2-selector-entry.sh
EXCLUDED_FILE_PRESENT=/root/rollback-step038b-cs3-selector-entry.sh
EXCLUDED_FILE_PRESENT=/root/rollback-step039d4-cs4-selector.sh
EXCLUDED_FILE_PRESENT=/root/rollback-step041g-wg-paid-peer-10-253-1-14.sh
EXCLUDED_FILE_PRESENT=/root/rollback-step041m2-fixed-selector.sh
EXCLUDED_FILE_PRESENT=/root/rollback-step044h-router-egress-activity.sh
EXCLUDED_FILE_PRESENT=/root/rollback-step044h2-router-egress-activity.sh
EXCLUDED_FILE_PRESENT=/root/rollback-step044h5-router-egress-activity.sh
EXCLUDED_FILE_PRESENT=/root/rollback-step044j3b-restore-wg-paid.sh
EXCLUDED_FILE_PRESENT=/root/rollback-step044p-restore-wg-paid.sh
EXCLUDED_FILE_PRESENT=/root/rollback-step046h-selector-20260710-073833.sh
EXCLUDED_FILE_PRESENT=/root/rollback-step046i3-selector-20260710-081054.sh
EXCLUDED_FILE_PRESENT=/root/rollback-step046i5-selector-20260710-095841.sh
EXCLUDED_FILE_PRESENT=/root/rollback-step046i5b-safety-20260710-100418.sh
EXCLUDED_FILE_PRESENT=/root/rollback-step046j-vm100-local-controller-20260710-100957.sh
EXCLUDED_FILE_PRESENT=/root/rollback-step046k-vm100-controller-v2-20260710-101958.sh
EXCLUDED_FILE_PRESENT=/root/rollback-step046l-vm100-controller-v3-20260710-104803.sh
EXCLUDED_FILE_PRESENT=/root/rollback-step046m-selector-20260710-110137.sh
EXCLUDED_FILE_PRESENT=/root/rollback-step046n-vm100-controller-v4-20260710-110427.sh
EXCLUDED_FILE_PRESENT=/root/rollback-step046o-vm100-controller-v5-20260710-113520.sh
EXCLUDED_FILE_PRESENT=/root/rollback-step046p-service-wrapper-20260710-113810.sh
EXCLUDED_FILE_PRESENT=/root/rollback-step046q-full-commit-20260710-114450.sh
EXCLUDED_FILE_PRESENT=/root/rollback-step046r-periodic-dryrun-20260710-114749.sh
EXCLUDED_FILE_PRESENT=/root/rollback-step046s-periodic-commit-20260710-115423.sh
EXCLUDED_FILE_PRESENT=/root/rollback-step046s2-periodic-commit-config-20260710-115918.sh
EXCLUDED_FILE_PRESENT=/root/rollback-step046t-commit-production-20260710-120316.sh
EXCLUDED_FILE_PRESENT=/root/rollback-step047a-v7-stateful-20260710-121955.sh
EXCLUDED_FILE_PRESENT=/root/rollback-step047b-v7-active-pin-20260710-122531.sh
EXCLUDED_FILE_PRESENT=/root/rollback-step047c-cooldown-20260710-123056.sh
EXCLUDED_FILE_PRESENT=/root/rollback-wgpaid-cs5-cleanup.sh
EXCLUDED_FILE_PRESENT=/root/step046h-selector-20260710-073833.backup
EXCLUDED_FILE_PRESENT=/root/step046i3-selector-20260710-081054.backup
EXCLUDED_FILE_PRESENT=/root/step046i5-selector-20260710-095841.backup
EXCLUDED_FILE_PRESENT=/root/step046i5b-safety-before-cleanup-20260710-100418.backup
EXCLUDED_FILE_PRESENT=/root/step046m-selector-20260710-110137.backup
EXCLUDED_FILE_PRESENT=/root/step046q-selector-20260710-114450.backup
EXCLUDED_FILE_PRESENT=/root/step046s-selector-20260710-115423.backup
EXCLUDED_FILE_PRESENT=/root/step046s2-init-20260710-115918.backup
EXCLUDED_FILE_PRESENT=/root/step046s2-loop-20260710-115918.backup
EXCLUDED_FILE_PRESENT=/root/step046s2-selector-20260710-115918.backup
EXCLUDED_FILE_PRESENT=/root/step046t-conf-20260710-120316.backup
EXCLUDED_FILE_PRESENT=/root/step046t-init-20260710-120316.backup
EXCLUDED_FILE_PRESENT=/root/step046t-loop-20260710-120316.backup
EXCLUDED_FILE_PRESENT=/root/step046t-selector-20260710-120316.backup
EXCLUDED_FILE_PRESENT=/root/step047a-conf-20260710-121955.backup
EXCLUDED_FILE_PRESENT=/root/step047a-script-20260710-121955.backup
EXCLUDED_FILE_PRESENT=/root/step047a-selector-20260710-121955.backup
EXCLUDED_FILE_PRESENT=/root/step047b-selector-20260710-122531.backup
EXCLUDED_FILE_PRESENT=/root/step047b-state-20260710-122531.backup
EXCLUDED_FILE_PRESENT=/root/step047c-selector-20260710-123056.backup
EXCLUDED_FILE_PRESENT=/root/step047c-state-20260710-123056.backup

>>> [07] Result
RESULT=PASS_VM100_GIT_CANDIDATE_CONTENT_REVIEW_READONLY
VM100_MODIFIED=false