{
  "checker": {
    "claims": [
      {
        "claim": "Diagnose pasted events or errors offline.",
        "command": "<guest-path> diagnose -f <guest-path>",
        "evidence": "DBG-SCC\n  title: Pod rejected by SecurityContextConstraints\n  confidence: 1.0\n  evidence:\n  - '2m          Warning   FailedCreate       replicaset/orders-api-6d9f7c9b8d    Error creating: pods \"orders-api-6d9f7c9b8d-\"\n    is forbidden: unable to validate against any security context constraint: [provider \"anonymuid\": Forbidden: not usable\n    by user or serviceaccount, spec.containers[0].securityCont'\n  rootCauses:\n  - 'The pod asks for something restricted-v2 forbids: fixed runAsUser/fsGroup outside the namespace range, privileged, hostPath,\n    hostNetwork, added capabilities, allowPrivilege",
        "expected": "DBG-SCC",
        "input": "examples/events-scc.txt",
        "kind": "claim",
        "outcome": "Real input produced the expected result: DBG-SCC",
        "returncode": 0,
        "source": "kube-noob diagnose 'paste events or errors'",
        "source_checked": true,
        "source_file": "README.md",
        "verdict": "yes"
      }
    ],
    "cycle_checks": [
      {
        "claim": "Scheduled or looping main behavior",
        "command": "",
        "evidence": "Inspected README quick start and CLI entry points; documentation describes finite audit, diagnose, learn and demo commands, no product scheduler or cycle trigger.",
        "expected": "identify the product trigger",
        "input": "source inspection",
        "kind": "cycle",
        "outcome": "Inspected README quick start and CLI entry points; documentation describes finite audit, diagnose, learn and demo commands, no product scheduler or cycle trigger.",
        "source": "repository entry points",
        "verdict": "yes"
      }
    ],
    "details": {
      "argv": [
        "<guest-path>",
        "demo",
        "diagnose"
      ],
      "kind": "cli",
      "needs_browser": false,
      "needs_credentials": false,
      "returncode": 0,
      "scope": "product operation",
      "stderr": "",
      "stdout": "== kube-noob demo: Diagnose SCC and CrashLoop/OOM failures, read-only first ==\n\n# Pods are never created: paste the events\n$ kube-noob diagnose -f examples/events-scc.txt\nDBG-SCC: Pod rejected by SecurityContextConstraints (confidence 1.0)\n  1. read-only first:\n     oc get events -n shop --field-selector reason=FailedCreate\n     oc describe rs -n shop -l <app-label>\n       why: FailedCreate message lists every SCC tried\n     oc get ns shop -o jsonpath='{.metadata.annotations.openshift\\.io/sa\\.scc\\.uid-range}'\n  2. change, only after the evidence (asks before running):\n     Remove runAsUser/runAsGroup/fsGroup and keep runAsNonRoot: true (preferred).\n[excerpt truncated]",
      "working": true
    },
    "evidence_strength": "readme_checked",
    "example_checks": [
      {
        "claim": "Offline diagnose SCC events",
        "command": "<guest-path> diagnose -f <guest-path>",
        "deferred": false,
        "evidence": "needs it: grant the least permissive SCC that fits (for example `oc adm policy add-scc-to-user\n      nonroot-v2 -z <serviceaccount> -n shop`); never privileged or anyuid for application workloads.'\n    requiresApproval: true\n    needsPolicyOwner: true\n  relatedRules:\n  - KN-S004\n  details:\n    triedProviders:\n      anonymuid:\n      - field: spec.containers[0].securityContext.runAsUser\n        error: Invalid value\n        detail: '1000: must be in the ranges: [1000680000, 1000689999]'\n    notUsableByServiceAccount:\n    - anonymuid\n    - restricted-v2\n    namespaceUidRange: 1000680000-1000689999",
        "expected": "DBG-SCC diagnosis",
        "input": "examples/events-scc.txt",
        "kind": "example",
        "outcome": "command completed successfully",
        "returncode": 0,
        "source": "README.md / Quick start",
        "verdict": "yes"
      }
    ],
    "status": "PASS"
  },
  "deviations": [
    "Git metadata was absent; source snapshot supplied and README operation did not require Git.",
    "README diagnosis demo itself was replayed as the primary probe; explicit diagnose input was also run and replayed as a claim/example."
  ],
  "fault_owner": null,
  "main_blocker": null,
  "operation": "Run kube-noob offline diagnose demo",
  "operation_scope": "Python 3.12.3 virtual environment; installed editable package from repository",
  "outcome": "working",
  "plain_failure": null,
  "steps": [
    "python3 -m venv .venv",
    ".venv/bin/pip install -e .",
    ".venv/bin/kube-noob demo diagnose",
    "<env-var>=<guest-path> python3 -I <guest-path> --validate --replay"
  ],
  "stuck_step": null,
  "suggested_fix": null
}