{ "assessment": { "all_selector_apply_ok": true, "apply_rc_ok": true, "peer_count_unchanged": true, "pending_global_zero": true, "preapply_ok": true, "remote_action_append": true, "remote_script_schema_seen": true, "rollback_path_created": true, "selector_count_incremented": true, "vm100_nft_now_present": true, "vm100_peer_still_present": true, "vm100_selector_now_present": true }, "changes": { "db_changed": "NO", "private_material_published": "NO", "selector_changed": "YES_APPEND_EXPECTED", "vm101_changed": "NO", "wg_paid_peer_changed": "NO" }, "mode": "CONTROLLED_REAL_CS5_SELECTOR_APPLY", "plan": { "action": "append", "apply_performed": false, "contract_valid": true, "error_count": 0, "errors": [], "exact_line": "10.253.1.14 cs5 canary_vpn2", "idempotent_noop": false, "mode": "remote-dry-run", "payload_summary": { "fwmark": "0x202", "interface_name": "vpn2", "manager_id": "hmn_pool", "provider_type": "hmn_amneziawg", "selector_class": "cs5", "selector_label": "canary_vpn2", "slot_code": "vpn2", "table_id": 202, "tunnel_ip": "10.253.1.14" }, "remote_commands_executed": false, "remote_script": "#!/bin/sh\nset -u\n\nCONF=/etc/router-wgpay-selector.d/peers.conf\nSERVICE=router-wgpay-canary\nLINE='10.253.1.14 cs5 canary_vpn2'\nTUNNEL_IP=10.253.1.14\nSELECTOR_CLASS=cs5\nBACKUP=\"/root/peers.conf.before-agent-selector-apply-$(date +%Y%m%d-%H%M%S)\"\nROLLBACK=\"/root/rollback-agent-selector-apply.sh\"\n\necho \"remote_script_schema=wg-access-agent-selector-remote-script-v3\"\necho \"remote_script_action=append\"\n\ntest -f \"$CONF\"\n\ncp \"$CONF\" \"$BACKUP\"\necho \"selector_backup_path=$BACKUP\"\n\ncat > \"$ROLLBACK\" <> \"$CONF\"\n echo \"selector_apply_action=append\"\nfi\n\n\n/etc/init.d/$SERVICE start\n\ngrep -Fxq \"$LINE\" \"$CONF\"\n/etc/init.d/$SERVICE enabled >/dev/null 2>&1\nnft -a list ruleset 2>/dev/null | grep -q \"$TUNNEL_IP.*$SELECTOR_CLASS\"\n\necho \"postcheck_selector_line_present=YES\"\necho \"postcheck_selector_service_enabled=YES\"\necho \"postcheck_nft_rule_visible=YES\"\n", "remote_script_contains_actual_backup_rollback": true, "remote_script_contains_bad_etc_initd_quoted_service": false, "remote_script_contains_clean_service_start": true, "remote_script_contains_placeholder_backup": false, "remote_script_contains_runtime_backup_date": true, "remote_script_executed": false, "remote_script_line_count": 46, "remote_script_model": "single_shell_script", "remote_script_sha256": "a26e23bd3d2d63e93017ed1e1ca0b27ba6329ee1143d39f3175c63d8078e8ae1", "requires_wg_peer_before_real_apply": true, "schema": "wg-access-agent-selector-remote-plan-v3", "selector_plan": { "action": "append", "apply_performed": false, "contract_valid": true, "errors": [], "exact_line": "10.253.1.14 cs5 canary_vpn2", "exact_present": false, "idempotent_noop": false, "mode": "dry-run", "payload_summary": { "fwmark": "0x202", "interface_name": "vpn2", "manager_id": "hmn_pool", "peer_id": "d54cd6da-c416-4245-a0dc-22182495f798", "provider_type": "hmn_amneziawg", "selector_class": "cs5", "selector_label": "canary_vpn2", "slot_code": "vpn2", "subscription_id": "52e5cf1d-f686-4efa-9c00-dce9a54c895e", "table_id": 202, "tunnel_ip": "10.253.1.14" }, "same_ip_conflict_count": 0, "same_selector_class_conflict_count": 0, "same_selector_label_conflict_count": 0, "schema": "wg-access-agent-selector-apply-plan-v1", "selector_entry_count_after_planned": 5, "selector_entry_count_before": 4, "slot_status": "healthy", "warnings": [], "would_append": true }, "selector_plan_rc": 0, "target": { "host": "10.71.100.1", "name": "vm100", "selector_conf": "/etc/router-wgpay-selector.d/peers.conf", "selector_service": "router-wgpay-canary" }, "would_append": true }, "preapply_guard": { "all_preapply_ok": true, "legacy_table200_ok": true, "plan_action_append": true, "plan_contract_valid": true, "plan_exact_line": true, "plan_remote_script_clean": true, "plan_would_append": true, "vm100_nft_absent": true, "vm100_peer_count_5": true, "vm100_peer_present": true, "vm100_selector_absent": true, "vm100_selector_count_4": true, "vm101_vpn2_ready": true }, "publish": { "current_trycf_url": "https://helena-background-beam-harry.trycloudflare.com", "local_report": "http://127.0.0.1:8099/r/e94a0859747d7b96f29c7fdafc2d0351ba603bb0a7e9e5a4/20260709-082325_step041d_controlled_cs5_selector_apply/", "trycf_report": "https://helena-background-beam-harry.trycloudflare.com/r/e94a0859747d7b96f29c7fdafc2d0351ba603bb0a7e9e5a4/20260709-082325_step041d_controlled_cs5_selector_apply/" }, "remote_apply": { "rc": 0, "stderr": "", "stdout": "remote_script_schema=wg-access-agent-selector-remote-script-v3\nremote_script_action=append\nselector_backup_path=/root/peers.conf.before-agent-selector-apply-20260709-082328\nrollback_path=/root/rollback-agent-selector-apply.sh\nselector_apply_action=append\napplied_vm100_wgpay_selector_rules=5\npostcheck_selector_line_present=YES\npostcheck_selector_service_enabled=YES\npostcheck_nft_rule_visible=YES\n" }, "schema": "router-step-facts-v1", "step": "STEP_041D_CONTROLLED_CS5_SELECTOR_APPLY", "target": { "fwmark": "0x202", "peer_id": "d54cd6da-c416-4245-a0dc-22182495f798", "selector_class": "cs5", "selector_line": "10.253.1.14 cs5 canary_vpn2", "slot_code": "vpn2", "table_id": 202, "tunnel_ip": "10.253.1.14" }, "vm100_after": { "nft_ip14_cs5_visible_rc": 0, "selector_count": 5, "selector_ip14_cs5_present_rc": 0, "selector_lines": [ "10.253.1.10 cs1 canary_vpn3", "10.253.1.11 cs2 canary_vpn4", "10.253.1.12 cs3 canary_vpn5", "10.253.1.13 cs4 canary_vpn1", "10.253.1.14 cs5 canary_vpn2" ], "selector_service_enabled_rc": 0, "wg_paid_ip14_peer_visible_rc": 0, "wg_paid_peer_count": 5 }, "vm100_before": { "nft_ip14_cs5_visible_rc": 1, "selector_count": 4, "selector_ip14_cs5_present_rc": 1, "selector_lines": [ "10.253.1.10 cs1 canary_vpn3", "10.253.1.11 cs2 canary_vpn4", "10.253.1.12 cs3 canary_vpn5", "10.253.1.13 cs4 canary_vpn1" ], "selector_service_enabled_rc": 0, "wg_paid_ip14_peer_visible_rc": 0, "wg_paid_peer_count": 5 }, "vm101_before": { "fwmark_0x202_rule_rc": 0, "legacy_table200_vpn1_rc": 0, "mapper_0x202_clear_rule_count": 1, "mapper_0x202_set_rule_count": 1, "slot_count": 5, "slot_registry_exists_rc": 0, "slots": { "vpn1": { "fwmark": "0x201", "interface_name": "vpn1", "selector_class": "cs4", "status": "healthy", "table_id": 201 }, "vpn2": { "fwmark": "0x202", "interface_name": "vpn2", "selector_class": "cs5", "status": "healthy", "table_id": 202 }, "vpn3": { "fwmark": "0x203", "interface_name": "vpn3", "selector_class": "cs1", "status": "healthy", "table_id": 203 }, "vpn4": { "fwmark": "0x204", "interface_name": "vpn4", "selector_class": "cs2", "status": "healthy", "table_id": 204 }, "vpn5": { "fwmark": "0x205", "interface_name": "vpn5", "selector_class": "cs3", "status": "healthy", "table_id": 205 } }, "status_json_parse_rc": 0, "status_run_rc": 0, "status_tool_exists_rc": 0, "table202_vpn2_route_rc": 0 }, "vm121_db_after": { "job_status_counts": { "completed": 41 }, "mode": "READ_ONLY_DB_AFTER_SELECTOR_APPLY", "peer_rows": [ { "created_at": "2026-07-04 13:28:02.964577+00", "disabled_at": "2026-07-04 15:13:41.913497+00", "enabled": "false", "id": "813515db-bf25-46c9-bc83-c9c45d51ba68", "node_id": "ddn-test", "public_key_md5": "6a14a78db834c09dd1bcb876ee832843", "tunnel_ip": "10.253.1.14" }, { "created_at": "2026-07-09 08:12:15.183587+00", "disabled_at": "", "enabled": "true", "id": "d54cd6da-c416-4245-a0dc-22182495f798", "node_id": "ddn-test", "public_key_md5": "0db8e90b312a67c6dbaa4952e1b0ddea", "tunnel_ip": "10.253.1.14" } ], "pending_global": 0, "pg_container_found": true, "schema": "router-step-facts-v1", "step": "STEP_041D_CONTROLLED_CS5_SELECTOR_APPLY" } }