# Read-only audit scope — VM121 / VM100 / VM101

## VM121

Collect only safe facts:

- hostname/OS/time;
- Machine Git check;
- managed paths;
- Docker containers/images/compose services;
- backend health/OpenAPI route summary;
- systemd units/timers;
- Alembic revision;
- PostgreSQL tables/columns/index definitions;
- counts and status aggregates;
- duplicate/null email counts without email values;
- peer IP/public-key duplicate counts without raw keys;
- jobs by status/action and oldest age;
- safe env names/values:
  endpoint, allowed IPs, pools, first IP, DNS, node/interface;
- secret values only as PRESENT/ABSENT or fingerprint where safe;
- listen sockets and host firewall;
- backup metadata;
- deprecated selector helper activation status.

## VM100

- Machine Git clean check and commit;
- interface/network/firewall/PBR summary with private keys redacted;
- current `wg_paid` runtime counts;
- selector/canonical/topology status;
- installed WireGuard/AmneziaWG packages;
- CLI/kernel/protocol support;
- candidate interface name/listen port/pool conflicts;
- routing/PBR/Direct/activity files that need multi-protocol generalization;
- UDP listeners;
- no mutation.

## VM101

- Machine Git and health;
- current public paid WG DNAT/forward rule;
- available candidate UDP ports;
- firewall/nft structure;
- public WAN/listen collision summary;
- no user keys, no endpoint secret disclosure;
- no mutation.

## Output

- report;
- safe facts JSON;
- separate raw-safe logs;
- current-state/gap register;
- latest archive with unchanged machine source snapshots;
- runtime impact false;
- no Project Source publication until conclusions are reviewed.