2e3aff7b17
sudo matches an argument vector exactly, so the sudoers line and the command the workflow runs have to agree character for character. Moving the dashboard to the proxy shortened the workflow's restorecon to five paths but left the grant listing six, which denies it. /var/www/tireless was never bob's to relabel in any case — the proxy's own grant covers it, and that one is scoped to static files alone. Refs #9 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013TxK1CWPkFXqdcXMJ4hVe6