=== VM130 environment ===
HOSTNAME=router-ops
UID=1000
UTC=2026-07-31T07:11:29Z
COMMAND_bash=present:/usr/bin/bash
COMMAND_python3=present:/usr/bin/python3
COMMAND_zip=absent
COMMAND_busybox=absent
COMMAND_curl=present:/usr/bin/curl
COMMAND_sha256sum=present:/usr/bin/sha256sum
COMMAND_flock=present:/usr/bin/flock
COMMAND_setsid=present:/usr/bin/setsid
COMMAND_nohup=present:/usr/bin/nohup

VM130_EXPECTED_FILE_COUNT=57
VM130_CURRENT_ROUTER_FILE_COUNT=57
VM130_CHANGED_COUNT=0
VM130_MISSING_COUNT=0
VM130_EXTRA_COUNT=0
VM130_PUBLISHED_BASELINE_MATCH=true

46e93496444408d8d8442203babc9431440482ed356cf8a729c2139dfeed2a61  /opt/router-ops/bin/router-step-bootstrap
56d2307d42bcb66dce9e771d69207fcf1d571636d8dcb31cb7a9f82cbadbfa24  /opt/router-ops/bin/router-bundle-gate
3af91f831d1cd59f98a3dfe676f11c60318da01b1c2fbc2df1abbc6d4ebc20e6  /opt/router-ops/bin/router-bundle-policy-r19
43c344872d23a75362155e501ab4d53dca038ccc4bea86989c67fc220f624a9f  /opt/router-ops/bin/router-bundle-policy-r20
39063aedee60080cc8bf09b562da9443ac2f16623353818b382a291185018ed0  /opt/router-ops/libexec/router-bundle-gate-r17
0128ae2d15e720b2859c884ec827b4e6e28aed7aacc9b39fad1ec113c7e591f1  /opt/router-ops/lib/router-step-workflow.sh
9fcc105d1d2f41d114801786b67804328e8d1d713683d42b4341a8bd460f42b7  /opt/router-ops/lib/router-publication-contract.sh
f682f7002e98d1ffe87f528979a1559885bb90c81978ecbd314db3b91c59f841  /opt/router-ops/bin/router-step-finalize
79c9e3c3d820d1cacc49ff68ad4990733e5089c1d6aef83f6bc406124f048504  /opt/router-ops/bin/router-public-safe-payload

>>> [vm100-source] precheck
MODE=--check
REPOSITORY_URL=https://github.com/DChuvelev/wg-paid-vm100.git
REPO_DIR=/opt/router-ops/state/source-repositories/wg-paid-vm100
>>> [vm100-source] run VM100 git publisher through approved nested SSH
>>> [vm100-git] precheck
MODE=--check
PROFILE=/etc/router-machine-git-source.conf
PROFILE_VERSION=2
PROFILE_SHA256=ee2c3b5366d8eb4c4ebf9766c07f6926ecc927e9c38a3766d870fc7397ab2743
MACHINE_ID=vm100
GIT_DIR=/root/.vm100-source.git
WORK_TREE=/
BRANCH=main
REMOTE_URL=git@github.com:DChuvelev/wg-paid-vm100.git
LOCAL_HEAD=2973959bbb942b23cf7fe3d68474111aa063d4f2
>>> [vm100-git] verify remote branch
ssh: Ignoring unknown configuration option 'IdentitiesOnly=yes'
REMOTE_HEAD=2973959bbb942b23cf7fe3d68474111aa063d4f2
>>> [vm100-git] build current project allowlist
>>> [vm100-git] read paths already tracked by git
CURRENT_ALLOWED_COUNT=29
TRACKED_COUNT=29
MANAGED_UNION_COUNT=29
>>> [vm100-git] strict path validation
STRICT_PATH_VALIDATION=true
>>> [vm100-git] show tracked files now missing from machine
TRACKED_PATH_MISSING_COUNT=0
>>> [vm100-git] build simulated git index
STAGED_CHANGE_COUNT=0
STAGED_PATHS=NONE
>>> [vm100-git] validate simulated staged paths
STAGED_PATH_VALIDATION=true
SIMULATED_TREE_SHA=4b35b85779e10d5b1465b44060aef11a9c99c4aa
SIMULATED_TREE_FILE_COUNT=29
>>> [vm100-git] high-confidence secret scan of simulated tree
HIGH_CONFIDENCE_SECRET_MATCHES=0
>>> [vm100-git] keyword review scan
KEYWORD_REVIEW_FILES=NONE

RESULT=PASS_vm100_GIT_PUBLISH_CHECK
MACHINE_ID=vm100
GIT_COMMIT=2973959bbb942b23cf7fe3d68474111aa063d4f2
GIT_TREE=4b35b85779e10d5b1465b44060aef11a9c99c4aa
GIT_FILE_COUNT=29
COMMIT_CREATED=false
PUSH_PERFORMED=false

VM100_RESULT=PASS_vm100_GIT_PUBLISH_CHECK
VM100_COMMIT=2973959bbb942b23cf7fe3d68474111aa063d4f2
VM100_REMOTE_COMMIT=2973959bbb942b23cf7fe3d68474111aa063d4f2
>>> [vm100-source] clone or refresh repository on VM130
CURRENT_ORIGIN=https://github.com/DChuvelev/wg-paid-vm100.git
From https://github.com/DChuvelev/wg-paid-vm100
 * branch            main       -> FETCH_HEAD
Reset branch 'main'
branch 'main' set up to track 'origin/main'.
Your branch is up to date with 'origin/main'.
HEAD is now at 2973959 vm100: publish managed source 2026-07-30T20:22:39Z

VM130_COMMIT=2973959bbb942b23cf7fe3d68474111aa063d4f2
VM130_TREE=4b35b85779e10d5b1465b44060aef11a9c99c4aa
VM130_FILE_COUNT=29
VM130_STATUS=CLEAN
>>> [vm100-source] verify required managed paths
REQUIRED_PATH_OK=etc/router-machine-git-source.conf
REQUIRED_PATH_OK=usr/local/sbin/router-machine-git-publish.sh
REQUIRED_PATH_OK=usr/local/sbin/router-vm100-git-publish.sh

RESULT=PASS_VM130_VM100_GIT_SOURCE_CHECK
VM100_COMMIT=2973959bbb942b23cf7fe3d68474111aa063d4f2
VM130_COMMIT=2973959bbb942b23cf7fe3d68474111aa063d4f2
VM130_TREE=4b35b85779e10d5b1465b44060aef11a9c99c4aa
VM130_FILE_COUNT=29
VM100_PUSH_PERFORMED=false
ARCHIVE_CREATED=false
PERMANENT_HTTPS_PUBLISHED=false

>>> [vm101-source] precheck
MODE=--check
REPOSITORY_URL=https://github.com/DChuvelev/wg-paid-vm101.git
REPO_DIR=/opt/router-ops/state/source-repositories/wg-paid-vm101
>>> [vm101-source] run VM101 git publisher through approved nested SSH
>>> [vm101-git] precheck
MODE=--check
PROFILE=/etc/router-machine-git-source.conf
PROFILE_VERSION=2
PROFILE_SHA256=3530bea6f101403d95fc82e37420a14b2a451d2774c03f3c9819679f011d24ab
MACHINE_ID=vm101
GIT_DIR=/root/.vm101-source.git
WORK_TREE=/
BRANCH=main
REMOTE_URL=git@github.com:DChuvelev/wg-paid-vm101.git
LOCAL_HEAD=e656f9bfde6d727292f38cae43e41811a23d6714
>>> [vm101-git] verify remote branch
REMOTE_HEAD=e656f9bfde6d727292f38cae43e41811a23d6714
>>> [vm101-git] build current project allowlist
>>> [vm101-git] read paths already tracked by git
CURRENT_ALLOWED_COUNT=55
TRACKED_COUNT=55
MANAGED_UNION_COUNT=55
>>> [vm101-git] strict path validation
STRICT_PATH_VALIDATION=true
>>> [vm101-git] show tracked files now missing from machine
TRACKED_PATH_MISSING_COUNT=0
>>> [vm101-git] build simulated git index
STAGED_CHANGE_COUNT=0
STAGED_PATHS=NONE
>>> [vm101-git] validate simulated staged paths
STAGED_PATH_VALIDATION=true
SIMULATED_TREE_SHA=48a6c4365ccde9caaec7765fa796f09cbd74771e
SIMULATED_TREE_FILE_COUNT=55
>>> [vm101-git] high-confidence secret scan of simulated tree
HIGH_CONFIDENCE_SECRET_MATCHES=0
>>> [vm101-git] keyword review scan
=== FILES REQUIRING KEYWORD REVIEW ===
48a6c4365ccde9caaec7765fa796f09cbd74771e:hmn/hmn-load-vpn-test.sh
48a6c4365ccde9caaec7765fa796f09cbd74771e:hmn/hmn-set-code.sh

RESULT=PASS_vm101_GIT_PUBLISH_CHECK
MACHINE_ID=vm101
GIT_COMMIT=e656f9bfde6d727292f38cae43e41811a23d6714
GIT_TREE=48a6c4365ccde9caaec7765fa796f09cbd74771e
GIT_FILE_COUNT=55
COMMIT_CREATED=false
PUSH_PERFORMED=false

VM101_PUBLISHER_RC=0

VM101_RESULT=PASS_vm101_GIT_PUBLISH_CHECK
VM101_COMMIT=e656f9bfde6d727292f38cae43e41811a23d6714
VM101_REMOTE_COMMIT=e656f9bfde6d727292f38cae43e41811a23d6714
>>> [vm101-source] clone or refresh repository on VM130
CURRENT_ORIGIN=https://github.com/DChuvelev/wg-paid-vm101.git
From https://github.com/DChuvelev/wg-paid-vm101
 * branch            main       -> FETCH_HEAD
Reset branch 'main'
branch 'main' set up to track 'origin/main'.
Your branch is up to date with 'origin/main'.
HEAD is now at e656f9b vm101: publish managed source 2026-07-29T18:01:01Z

VM130_COMMIT=e656f9bfde6d727292f38cae43e41811a23d6714
VM130_TREE=48a6c4365ccde9caaec7765fa796f09cbd74771e
VM130_FILE_COUNT=55
VM130_STATUS=CLEAN
>>> [vm101-source] verify required managed paths
REQUIRED_PATH_OK=etc/crontabs/root
REQUIRED_PATH_OK=usr/local/sbin/router-vm101-git-publish.sh

RESULT=PASS_VM130_VM101_GIT_SOURCE_CHECK
VM101_COMMIT=e656f9bfde6d727292f38cae43e41811a23d6714
VM130_COMMIT=e656f9bfde6d727292f38cae43e41811a23d6714
VM130_TREE=48a6c4365ccde9caaec7765fa796f09cbd74771e
VM130_FILE_COUNT=55
VM101_PUSH_PERFORMED=false
ARCHIVE_CREATED=false
PERMANENT_HTTPS_PUBLISHED=false

>>> [vm121-source] precheck
MODE=--check
REPOSITORY_URL=https://github.com/DChuvelev/wg-paid-vm121.git
REPO_DIR=/opt/router-ops/state/source-repositories/wg-paid-vm121
>>> [vm121-source] run VM121 git publisher through approved direct SSH
>>> [vm121-git] precheck
MODE=--check
PROFILE=/etc/router-machine-git-source.conf
PROFILE_VERSION=2
PROFILE_SHA256=119996c097d5302e4911488ac542dd0b5105ea64c4775f476181bafa21eab60a
MACHINE_ID=vm121
GIT_DIR=/root/.vm121-source.git
WORK_TREE=/
BRANCH=main
REMOTE_URL=git@github.com:DChuvelev/wg-paid-vm121.git
LOCAL_HEAD=93e0e5a31f0900a498b77d22e6a7f2ca5fd7fee0
>>> [vm121-git] verify remote branch
REMOTE_HEAD=93e0e5a31f0900a498b77d22e6a7f2ca5fd7fee0
>>> [vm121-git] build current project allowlist
>>> [vm121-git] read paths already tracked by git
CURRENT_ALLOWED_COUNT=41
TRACKED_COUNT=41
MANAGED_UNION_COUNT=41
>>> [vm121-git] strict path validation
STRICT_PATH_VALIDATION=true
>>> [vm121-git] show tracked files now missing from machine
TRACKED_PATH_MISSING_COUNT=0
>>> [vm121-git] build simulated git index
STAGED_CHANGE_COUNT=0
STAGED_PATHS=NONE
>>> [vm121-git] validate simulated staged paths
STAGED_PATH_VALIDATION=true
SIMULATED_TREE_SHA=b6fb72951eedc96decf445b71e7d9d6e77ec5ee3
SIMULATED_TREE_FILE_COUNT=41
>>> [vm121-git] high-confidence secret scan of simulated tree
HIGH_CONFIDENCE_SECRET_MATCHES=0
>>> [vm121-git] keyword review scan
KEYWORD_REVIEW_FILES=NONE

RESULT=PASS_VM121_GIT_PUBLISH_CHECK
MACHINE_ID=vm121
GIT_COMMIT=93e0e5a31f0900a498b77d22e6a7f2ca5fd7fee0
GIT_TREE=b6fb72951eedc96decf445b71e7d9d6e77ec5ee3
GIT_FILE_COUNT=41
COMMIT_CREATED=false
PUSH_PERFORMED=false

VM121_RESULT=PASS_VM121_GIT_PUBLISH_CHECK
VM121_COMMIT=93e0e5a31f0900a498b77d22e6a7f2ca5fd7fee0
VM121_REMOTE_COMMIT=93e0e5a31f0900a498b77d22e6a7f2ca5fd7fee0
>>> [vm121-source] clone or refresh repository on VM130
CURRENT_ORIGIN=https://github.com/DChuvelev/wg-paid-vm121.git
From https://github.com/DChuvelev/wg-paid-vm121
 * branch            main       -> FETCH_HEAD
Reset branch 'main'
branch 'main' set up to track 'origin/main'.
Your branch is up to date with 'origin/main'.
HEAD is now at 93e0e5a vm121: baseline WG Access control-plane source

VM130_COMMIT=93e0e5a31f0900a498b77d22e6a7f2ca5fd7fee0
VM130_TREE=b6fb72951eedc96decf445b71e7d9d6e77ec5ee3
VM130_FILE_COUNT=41
VM130_STATUS=CLEAN
>>> [vm121-source] verify required managed paths
REQUIRED_PATH_OK=etc/router-machine-git-source.conf
REQUIRED_PATH_OK=usr/local/sbin/router-machine-git-publish.sh
REQUIRED_PATH_OK=usr/local/sbin/router-vm121-git-publish.sh

RESULT=PASS_VM130_VM121_GIT_SOURCE_CHECK
VM121_COMMIT=93e0e5a31f0900a498b77d22e6a7f2ca5fd7fee0
VM130_COMMIT=93e0e5a31f0900a498b77d22e6a7f2ca5fd7fee0
VM130_TREE=b6fb72951eedc96decf445b71e7d9d6e77ec5ee3
VM130_FILE_COUNT=41
VM121_PUSH_PERFORMED=false
ARCHIVE_CREATED=false
PERMANENT_HTTPS_PUBLISHED=false

MACHINE=VM100
UTC=2026-07-31T07:11:37Z
FILE_PRESENT=/var/lib/router-wgpay-direct-mode/state.kv
FILE_PRESENT=/var/lib/router-wgpay-topology/state.kv
DIRECT_SCHEMA=router-wgpay-direct-mode-state-v1
DIRECT_ACTIVE=false
DIRECT_MODE=NORMAL
TOPOLOGY_schema=router-wgpay-slot-topology-state-v2
TOPOLOGY_mode=NORMAL
TOPOLOGY_generation_id=
TOPOLOGY_healthy_count=
TOPOLOGY_pending=
TOPOLOGY_direct_required=
TOPOLOGY_updated_at_epoch=
CANONICAL.CONF_ENTRY_COUNT=5
PEERS.CONF_ENTRY_COUNT=5
SERVICE_router-wgpay-egress-local_ENABLED_RC=0 SERVICE_router-wgpay-egress-local_RUNNING_RC=0
SERVICE_router-wgpay-canary_ENABLED_RC=0 SERVICE_router-wgpay-canary_RUNNING_RC=0
SERVICE_router-egress-activity_ENABLED_RC=0 SERVICE_router-egress-activity_RUNNING_RC=0
default via 10.201.0.2 dev eth0 proto static metric 10 
default via 10.200.0.2 dev eth2 proto static metric 20 
10.200.0.0/24 dev eth2 proto static scope link metric 20 
10.201.0.0/24 dev eth0 proto static scope link metric 10 
RESULT=PASS_R20QUA0_VM100_READ_ONLY

MACHINE=VM101
UTC=2026-07-31T07:11:38Z
RECOVERY_schema=
RECOVERY_mode=NORMAL
RECOVERY_active_generation_id=r20c-20260730-205427-3926
RECOVERY_full_refresh_due=false
RECOVERY_next_refresh_epoch=0
RECOVERY_refresh_retry_count=0
RECOVERY_last_refresh_result=PASS
RECOVERY_last_retry_result=PASS
RUNTIME_GENERATION_DIR_PRESENT=true
RUNTIME_ACTIVE_LINK=/var/lib/router-egress-recovery/generations/staging/r20c-20260730-205427-3926
VPN1_LINK_PRESENT=true
TABLE201_ROUTE_COUNT=1
VPN1_UCI_PROTO=amneziawg VPN1_UCI_DEVICE= VPN1_UCI_IP4TABLE=
VPN2_LINK_PRESENT=true
TABLE202_ROUTE_COUNT=1
VPN2_UCI_PROTO=amneziawg VPN2_UCI_DEVICE= VPN2_UCI_IP4TABLE=
VPN3_LINK_PRESENT=true
TABLE203_ROUTE_COUNT=1
VPN3_UCI_PROTO=amneziawg VPN3_UCI_DEVICE= VPN3_UCI_IP4TABLE=
VPN4_LINK_PRESENT=true
TABLE204_ROUTE_COUNT=1
VPN4_UCI_PROTO=amneziawg VPN4_UCI_DEVICE= VPN4_UCI_IP4TABLE=
VPN5_LINK_PRESENT=true
TABLE205_ROUTE_COUNT=1
VPN5_UCI_PROTO=amneziawg VPN5_UCI_DEVICE= VPN5_UCI_IP4TABLE=
SERVICE_router-wgpay-topology-delivery_START=96 ENABLED_RC=0 RUNNING_RC=0
SERVICE_router-egress-provider-direct_START=96 ENABLED_RC=0 RUNNING_RC=0
SERVICE_router-egress-zero-healthy-bootstrap_START=97 ENABLED_RC=0 RUNNING_RC=0
SERVICE_router-egress-health-repair_START=98 ENABLED_RC=0 RUNNING_RC=0
SERVICE_router-egress-slots_START=98 ENABLED_RC=0 RUNNING_RC=0
SERVICE_router-egress-full-pool-refresh-retry_START=99 ENABLED_RC=0 RUNNING_RC=0
PROVIDER_DIRECT_ENABLED=1
PROVIDER_DIRECT_INTERFACE=eth0
HEALTHY_SLOT_COUNT=0
TOPOLOGY_FILE_PRESENT=/etc/router-wgpay-topology-delivery/state.kv
RESULT=PASS_R20QUA0_VM101_READ_ONLY

d75ccc901080960ee8a7dbd8d5d99ae7699fdf21df0130767c9139bef26fcee7  /etc/router-wgpay-slot-topology.conf
46d41783effb8d80ea1b09895f829b98a0946e0edbff1e29e7651eb3ef9b036a  /etc/router-wgpay-selector.d/canonical.conf
46d41783effb8d80ea1b09895f829b98a0946e0edbff1e29e7651eb3ef9b036a  /etc/router-wgpay-selector.d/peers.conf
43bab9cdf6fd504134d5c8fddee811aeebcc2187b8bf36114caec198b348f311  /usr/local/lib/router-wgpay-slot-topology-lib.sh
03bdf6186f3624d167846d0a5f85d4f9a58d1cfe50522d7dd527dd19e1e50e92  /usr/local/sbin/router-wgpay-slot-topology-apply.sh
06649e2a86993f9a5cf7046ef3685ba6e217eb787642950a93888d03a292fe21  /usr/local/sbin/router-wgpay-direct-mode.sh
82cde2c97caf0ae438c773cd7be1d695d9dacb53cce94647158f0af7e73617d1  /usr/local/sbin/router-wgpay-slot-topology-forced-command.sh

EXPECTED_COUNT=7
ACTUAL_COUNT=7
MISSING_COUNT=0
EXTRA_COUNT=0
CHANGED_COUNT=0
CRITICAL_BASELINE_MATCH=true

d9013d65e3b2538c0cfddc98d0585d71616bd847b89e68ef776ac9ac3780c254  /etc/router-egress-generation.conf
a4d59b67d514ab0e19fd4ed0108ef0818cc1ad8a92aa373de744b35b82841ff6  /etc/router-egress-vm101.conf
6e3ccd23355727b1d4a82e24e30aca29e7087fdf21ba773ae109576da88267da  /etc/router-egress-recovery-hmn.conf
a13cccd6401bc5075813a3919e7b29dd867f8a01db4d2f95f6ae9752a45b4aef  /etc/router-egress-zero-healthy-bootstrap.conf
42ba3c0b10d8535d4100cc4e35e02bc2c0f3fe104bdedf8cf91700832d9051a8  /etc/init.d/router-egress-slots
3c504e60266ccc967b19dcc2c10301e4bb20c7494ef7f74174f1ac6529b3e37f  /etc/init.d/router-egress-zero-healthy-bootstrap
e4f77838850bbfff95f9ac5694ae3c516d2d3a93fa82893a234a057e1be026e6  /etc/init.d/router-egress-full-pool-refresh-retry
15e10cba2fee582f83b76df8a79e27217ad4baed7df6fed521ef701b13841ea9  /usr/local/lib/router-egress-recovery-state.sh
f6532913f40cc38deeec058744b939dbc57b871a04a7ca92e5dc838c2c78c123  /usr/local/sbin/router-egress-zero-healthy-bootstrap.sh
4c0c84442a474487612b5e4c7930ed1425ee657fe9d5f445b632087aef3cc108  /usr/local/sbin/router-egress-full-pool-refresh.sh
8e68be278410e9267a92ca58c3fb25c51bbf443530e77c577b39e82e7afb1234  /usr/local/sbin/router-egress-full-pool-refresh-retry.sh
021c2a6ebff248e363709709f8b0f8f2ee3997d6a115e3fec029239f34edcc0a  /usr/local/sbin/router-egress-slots-apply.sh
f59b61b04f8d8d18b9ef8e536d65b424498b9f094e17a79f8193b5cc660c4b8c  /usr/local/sbin/router-egress-generation-activate
94228d9135d267160cdfd21f0e042bf59a89d1251a7055222c88fb50fb7ff6bb  /usr/local/sbin/router-wgpay-topology-reconcile.sh

EXPECTED_COUNT=14
ACTUAL_COUNT=14
MISSING_COUNT=0
EXTRA_COUNT=0
CHANGED_COUNT=0
CRITICAL_BASELINE_MATCH=true