=== STEP_034H3 RUN AGENT ONCE GUARDED ===
timestamp=20260708-121659
mode=real change via existing wg-access-agent.service only
peer_id=376dfa07-0ba4-4182-af39-389a2cb3badd
job_id=95463317-b0a0-4117-84fd-2a0dcf387741
tunnel_ip=10.253.1.10
guard: run agent only if pending job set is exactly this job
forbidden: manual wg set, manual peer write, backend restart, postgres restart
=== before backend jobs/peer ===
peers_before_curl_rc=0
jobs_before_curl_rc=0
peer_found_before=True
peer_enabled_before=True
peer_public_key=fmcqSUy1fErBV5RrcoVoex2VAgaxz2i79GzK8qd88UI=
peer_tunnel_ip_before=10.253.1.10
pending_job_count_before=1
PENDING_JOB_BEFORE id=95463317-b0a0-4117-84fd-2a0dcf387741 action=enable_peer node_id=ddn-test status=pending attempts=0
target_job_found_before=True
target_job_status_before=pending
target_job_action_before=enable_peer
target_job_node_id_before=ddn-test
guard_pending_count=1
guard_only_target=1
guard_target_action=enable_peer
guard_target_status=pending

=== agent service before ===
○ wg-access-agent.service - WG Access Agent real poller
     Loaded: loaded (/etc/systemd/system/wg-access-agent.service; static)
     Active: inactive (dead) since Mon 2026-07-06 18:48:38 UTC; 1 day 17h ago
    Process: 440716 ExecStart=/opt/wg-access/agent/wg_access_agent.py (code=<REDACTED>, status=0/SUCCESS)
   Main PID: 440716 (code=<REDACTED>, status=0/SUCCESS)
        CPU: 134ms

Jul 06 18:48:38 wg-access-dev wg_access_agent.py[440716]: [2026-07-06T18:48:38.432384+00:00] fetched pending jobs: 1
Jul 06 18:48:38 wg-access-dev wg_access_agent.py[440716]: [2026-07-06T18:48:38.432485+00:00] starting job_id=c2d55542-713c-4cb2-9040-7d64bdf511bb action=disable_peer
Jul 06 18:48:38 wg-access-dev wg_access_agent.py[440716]: [2026-07-06T18:48:38.904617+00:00] remote stdout: interface: wg_paid
Jul 06 18:48:38 wg-access-dev wg_access_agent.py[440716]:   public key: FD1J+KVZ965pCjgtO0YWxJsKANY9uz6v1P54JLkiZzY=
Jul 06 18:48:38 wg-access-dev wg_access_agent.py[440716]:   private key: <REDACTED>
Jul 06 18:48:38 wg-access-dev wg_access_agent.py[440716]:   listening port: 51830
Jul 06 18:48:38 wg-access-dev wg_access_agent.py[440716]: [2026-07-06T18:48:38.905015+00:00] REAL disable_peer peer_id=3d03a7a2-c009-48a4-b6ff-214326d26fc0
Jul 06 18:48:38 wg-access-dev wg_access_agent.py[440716]: [2026-07-06T18:48:38.911811+00:00] completed job_id=c2d55542-713c-4cb2-9040-7d64bdf511bb status=completed attempts=1
Jul 06 18:48:38 wg-access-dev systemd[1]: wg-access-agent.service: Deactivated successfully.
Jul 06 18:48:38 wg-access-dev systemd[1]: Finished wg-access-agent.service - WG Access Agent real poller.

=== action: start existing wg-access-agent.service once, guarded ===
agent_start_rc=0

=== agent service after ===
○ wg-access-agent.service - WG Access Agent real poller
     Loaded: loaded (/etc/systemd/system/wg-access-agent.service; static)
     Active: inactive (dead) since Wed 2026-07-08 12:17:01 UTC; 7ms ago
    Process: 750077 ExecStart=/opt/wg-access/agent/wg_access_agent.py (code=<REDACTED>, status=0/SUCCESS)
   Main PID: 750077 (code=<REDACTED>, status=0/SUCCESS)
        CPU: 136ms

Jul 08 12:17:01 wg-access-dev wg_access_agent.py[750077]:   public key: FD1J+KVZ965pCjgtO0YWxJsKANY9uz6v1P54JLkiZzY=
Jul 08 12:17:01 wg-access-dev wg_access_agent.py[750077]:   private key: <REDACTED>
Jul 08 12:17:01 wg-access-dev wg_access_agent.py[750077]:   listening port: 51830
Jul 08 12:17:01 wg-access-dev wg_access_agent.py[750077]: peer: fmcqSUy1fErBV5RrcoVoex2VAgaxz2i79GzK8qd88UI=
Jul 08 12:17:01 wg-access-dev wg_access_agent.py[750077]:   preshared key: <REDACTED>
Jul 08 12:17:01 wg-access-dev wg_access_agent.py[750077]:   allowed ips: 10.253.1.10/32
Jul 08 12:17:01 wg-access-dev wg_access_agent.py[750077]: [2026-07-08T12:17:01.077810+00:00] REAL enable_peer peer_id=376dfa07-0ba4-4182-af39-389a2cb3badd tunnel_ip=10.253.1.10
Jul 08 12:17:01 wg-access-dev wg_access_agent.py[750077]: [2026-07-08T12:17:01.085762+00:00] completed job_id=95463317-b0a0-4117-84fd-2a0dcf387741 status=completed attempts=1
Jul 08 12:17:01 wg-access-dev systemd[1]: wg-access-agent.service: Deactivated successfully.
Jul 08 12:17:01 wg-access-dev systemd[1]: Finished wg-access-agent.service - WG Access Agent real poller.

=== recent agent journal ===
Jul 08 12:17:01 wg-access-dev wg_access_agent.py[750077]: [2026-07-08T12:17:00.406550+00:00] sync set peer tunnel_ip=10.253.1.10
Jul 08 12:17:01 wg-access-dev wg_access_agent.py[750077]: [2026-07-08T12:17:00.567546+00:00] remote stdout: interface: wg_paid
Jul 08 12:17:01 wg-access-dev wg_access_agent.py[750077]:   allowed ips: 10.253.1.10/32
Jul 08 12:17:01 wg-access-dev wg_access_agent.py[750077]: [2026-07-08T12:17:00.573457+00:00] starting job_id=95463317-b0a0-4117-84fd-2a0dcf387741 action=enable_peer
Jul 08 12:17:01 wg-access-dev wg_access_agent.py[750077]: [2026-07-08T12:17:01.077314+00:00] remote stdout: interface: wg_paid
Jul 08 12:17:01 wg-access-dev wg_access_agent.py[750077]:   allowed ips: 10.253.1.10/32
Jul 08 12:17:01 wg-access-dev wg_access_agent.py[750077]: [2026-07-08T12:17:01.077810+00:00] REAL enable_peer peer_id=376dfa07-0ba4-4182-af39-389a2cb3badd tunnel_ip=10.253.1.10
Jul 08 12:17:01 wg-access-dev wg_access_agent.py[750077]: [2026-07-08T12:17:01.085762+00:00] completed job_id=95463317-b0a0-4117-84fd-2a0dcf387741 status=completed attempts=1

=== after backend jobs/peer ===
peers_after_curl_rc=0
jobs_after_curl_rc=0
peer_found_after=True
peer_enabled_after=True
peer_tunnel_ip_after=10.253.1.10
target_job_found_after=True
target_job_status_after=completed
target_job_attempts_after=1
target_job_last_error_after=None
pending_job_count_after=0

=== health ===
{"status":"ok","service":"wg-access-backend","environment":"dev"}
{"status":"ok","db":1}
=== safety proof ===
used_existing_agent_service=1
no_manual_wg_set=1
no_manual_peer_write=1
no_backend_restart=1
no_postgres_restart=1
vm121_agent_run_done=1

=== VM100 verify after agent ===
date=Wed Jul  8 12:17:02 UTC 2026

=== wg_paid after agent ===
interface: wg_paid
  public key: FD1J+KVZ965pCjgtO0YWxJsKANY9uz6v1P54JLkiZzY=
  private key: (hidden)
  listening port: 51830

peer: fmcqSUy1fErBV5RrcoVoex2VAgaxz2i79GzK8qd88UI=
  preshared key: (hidden)
  allowed ips: 10.253.1.10/32

=== checks ===
wg_paid_peer_count_after=1
vm100_pubkey_in_wg_show_rc=0
vm100_pubkey_in_wg_dump_rc=0
vm100_allowed_ip_match_rc=0

no_manual_peer_write_vm100=1
no_wg_reload_vm100=1
vm100_verify_done=1

=== STEP_034H3 RESULT ===
guard_only_target=1
agent_start_rc=0
target_job_status_after=completed
target_job_attempts_after=1
pending_job_count_after=0
wg_paid_peer_count_after=1
vm100_pubkey_in_wg_show_rc=0
vm100_pubkey_in_wg_dump_rc=0
vm100_allowed_ip_match_rc=0
backend_health_ok_lines=2
decision=PASS_AGENT_APPLIED_CANARY_PEER