{
  "allowed_decisions": [
    "confirm",
    "defer",
    "reject",
    "request_more_evidence"
  ],
  "blocked_requests": [
    "repo_create",
    "visibility_change",
    "refs_sync",
    "refs_delete",
    "force_push",
    "workflow_modify",
    "runner_enable",
    "secret_value_submit",
    "ssh_host_modify",
    "nginx_reload",
    "dns_tls_modify",
    "argocd_sync",
    "kubectl_apply",
    "active_scan",
    "agent_bounty_runtime_execute",
    "payout_or_withdrawal"
  ],
  "canonical_owner_fields": [
    "owner_role_or_team",
    "decision",
    "decision_reason",
    "affected_scope",
    "redacted_evidence_refs",
    "followup_owner",
    "rollback_owner",
    "maintenance_window",
    "validation_plan"
  ],
  "completion": {
    "owner_request_sent_percent": 0,
    "owner_response_received_percent": 0,
    "request_dispatch_preflight_artifact_percent": 100,
    "reviewer_accepted_percent": 0,
    "runtime_gate_percent": 0
  },
  "dispatch_preflight_checks": [
    {
      "check_id": "baseline_commit_synced",
      "gate_effect": "不增加 request_sent / received / accepted / runtime gate。",
      "instruction": "使用最新 gitea/main 與 owner packet snapshot；不得用過期 packet 送件。",
      "label": "基線 commit 已同步",
      "required": true,
      "status": "preflight_required_before_request_dispatch"
    },
    {
      "check_id": "source_snapshot_current",
      "gate_effect": "不增加 request_sent / received / accepted / runtime gate。",
      "instruction": "來源必須是 committed high-value-config-owner-packet snapshot，不讀 live 主機。",
      "label": "來源 snapshot 目前有效",
      "required": true,
      "status": "preflight_required_before_request_dispatch"
    },
    {
      "check_id": "packet_scope_mapped",
      "gate_effect": "不增加 request_sent / received / accepted / runtime gate。",
      "instruction": "每包需有 category、priority、control tier、required gate 與 affected files。",
      "label": "Packet scope 已映射",
      "required": true,
      "status": "preflight_required_before_request_dispatch"
    },
    {
      "check_id": "canonical_fields_present",
      "gate_effect": "不增加 request_sent / received / accepted / runtime gate。",
      "instruction": "每包需要求 owner role、decision、reason、scope、evidence refs、followup、rollback、window、validation。",
      "label": "Canonical 欄位已固定",
      "required": true,
      "status": "preflight_required_before_request_dispatch"
    },
    {
      "check_id": "redacted_evidence_refs_only",
      "gate_effect": "不增加 request_sent / received / accepted / runtime gate。",
      "instruction": "只收文件路徑、snapshot id、ticket id、commit、hash 或 metadata pointer。",
      "label": "Evidence refs 只允許脫敏參照",
      "required": true,
      "status": "preflight_required_before_request_dispatch"
    },
    {
      "check_id": "no_sensitive_payload",
      "gate_effect": "不增加 request_sent / received / accepted / runtime gate。",
      "instruction": "不得收 token、secret、private key、cookie、session、authorization header、runner token 或 webhook secret。",
      "label": "禁止敏感 payload",
      "required": true,
      "status": "preflight_required_before_request_dispatch"
    },
    {
      "check_id": "no_execution_request",
      "gate_effect": "不增加 request_sent / received / accepted / runtime gate。",
      "instruction": "不得夾帶 reload、deploy、sync、host write、active scan、payout 或 withdrawal。",
      "label": "拒收執行要求",
      "required": true,
      "status": "preflight_required_before_request_dispatch"
    },
    {
      "check_id": "maintenance_and_rollback_fields_present",
      "gate_effect": "不增加 request_sent / received / accepted / runtime gate。",
      "instruction": "C0 / P0 仍需獨立人工批准、維護窗口與 rollback owner，不能由 packet 自動授權。",
      "label": "維護窗口與回滾 owner 欄位存在",
      "required": true,
      "status": "preflight_required_before_request_dispatch"
    },
    {
      "check_id": "validation_plan_present",
      "gate_effect": "不增加 request_sent / received / accepted / runtime gate。",
      "instruction": "必須能說明 preflight、post-check、rollback check；只讀文件變更則對應 guard / JSON / doc sanity。",
      "label": "驗證計畫欄位存在",
      "required": true,
      "status": "preflight_required_before_request_dispatch"
    }
  ],
  "execution_boundaries": {
    "action_buttons_allowed": false,
    "active_scan_authorized": false,
    "dispatch_authorized": false,
    "dns_tls_change_authorized": false,
    "host_write_authorized": false,
    "nginx_reload_authorized": false,
    "not_authorization": true,
    "production_write_authorized": false,
    "request_sent": false,
    "reviewer_queue_write": false,
    "runtime_execution_authorized": false,
    "secret_value_collection_allowed": false,
    "workflow_modification_authorized": false
  },
  "generated_at": "2026-06-14T18:25:00+08:00",
  "git_commit": "3de776f4",
  "intake_packets": [
    {
      "accepted_response": false,
      "action_buttons_allowed": false,
      "affected_file_count": 2,
      "affected_files": [
        "scripts/ops/188-registry-certbot-fix.sh",
        "scripts/ops/fix-188-registry-certbot-renewal.sh"
      ],
      "category_id": "dns_tls_certbot",
      "control_tier": "C0",
      "label": "DNS / TLS / certbot / certificate path",
      "not_authorization": true,
      "packet_id": "high_value_config_owner_packet:dns_tls_certbot",
      "priority": "P0",
      "production_write_authorized": false,
      "received_response": false,
      "rejected_response": false,
      "request_sent": false,
      "required_gate": "domain_tls_owner_response_required",
      "required_owner_fields": [
        "owner_role_or_team",
        "decision",
        "decision_reason",
        "affected_scope",
        "redacted_evidence_refs",
        "followup_owner",
        "rollback_owner",
        "maintenance_window",
        "validation_plan"
      ],
      "required_validation": [
        "domain_inventory",
        "certificate_path_check",
        "renewal_window",
        "acme_path_smoke",
        "public_https_smoke",
        "rollback_ref"
      ],
      "reviewer_queue_write": false,
      "runtime_gate": false,
      "secret_value_collection_allowed": false,
      "status": "waiting_request_dispatch_preflight"
    },
    {
      "accepted_response": false,
      "action_buttons_allowed": false,
      "affected_file_count": 1,
      "affected_files": [
        "k8s/nginx/awoooi-prod.conf"
      ],
      "category_id": "nginx_public_gateway",
      "control_tier": "C0",
      "label": "Nginx / reverse proxy / public route",
      "not_authorization": true,
      "packet_id": "high_value_config_owner_packet:nginx_public_gateway",
      "priority": "P0",
      "production_write_authorized": false,
      "received_response": false,
      "rejected_response": false,
      "request_sent": false,
      "required_gate": "public_gateway_owner_response_required",
      "required_owner_fields": [
        "owner_role_or_team",
        "decision",
        "decision_reason",
        "affected_scope",
        "redacted_evidence_refs",
        "followup_owner",
        "rollback_owner",
        "maintenance_window",
        "validation_plan"
      ],
      "required_validation": [
        "rendered_diff",
        "nginx_t",
        "affected_route_smoke",
        "admin_route_smoke_if_affected",
        "acme_path_smoke_if_affected",
        "rollback_ref"
      ],
      "reviewer_queue_write": false,
      "runtime_gate": false,
      "secret_value_collection_allowed": false,
      "status": "waiting_request_dispatch_preflight"
    },
    {
      "accepted_response": false,
      "action_buttons_allowed": false,
      "affected_file_count": 3,
      "affected_files": [
        "docs/security/HIGH-VALUE-CONFIG-CHANGE-GATE.md",
        "docs/security/high-value-config-change-gate.snapshot.json",
        "scripts/security/high-value-config-change-gate.py"
      ],
      "category_id": "security_evidence_tooling",
      "control_tier": "C3",
      "label": "Security evidence / snapshot / guard tooling",
      "not_authorization": true,
      "packet_id": "high_value_config_owner_packet:security_evidence_tooling",
      "priority": "P3",
      "production_write_authorized": false,
      "received_response": false,
      "rejected_response": false,
      "request_sent": false,
      "required_gate": "security_evidence_owner_review_required",
      "required_owner_fields": [
        "owner_role_or_team",
        "decision",
        "decision_reason",
        "affected_scope",
        "redacted_evidence_refs",
        "followup_owner",
        "rollback_owner",
        "maintenance_window",
        "validation_plan"
      ],
      "required_validation": [
        "snapshot_parse",
        "guard_smoke",
        "doc_secret_sanity",
        "no_runtime_gate_increase"
      ],
      "reviewer_queue_write": false,
      "runtime_gate": false,
      "secret_value_collection_allowed": false,
      "status": "waiting_request_dispatch_preflight"
    }
  ],
  "next_steps": [
    "先由 reviewer 確認預檢 snapshot 與 owner packet snapshot 皆為最新 committed evidence。",
    "送件前只準備脫敏欄位與禁止條款，不送 secret value、不附 raw payload。",
    "收到回覆後先依 intake lanes 分流；通過 reviewer validation 之前 received / accepted 不得增加。",
    "任何 runtime、Nginx reload、DNS / TLS、workflow、runner、host 或 payout 動作都必須切獨立人工批准。"
  ],
  "reviewer_intake_lanes": [
    {
      "gate_effect": "request / received / accepted / rejected 維持 0。",
      "instruction": "尚未收到 owner response 或只有空白 / 口頭同意時維持等待。",
      "lane_id": "keep_waiting_owner_response",
      "status": "reviewer_intake_lane_defined"
    },
    {
      "gate_effect": "不得增加 accepted 或 runtime gate。",
      "instruction": "欄位缺漏、scope 不清或 redacted evidence refs 不足時補件。",
      "lane_id": "request_more_evidence",
      "status": "reviewer_intake_lane_defined"
    },
    {
      "gate_effect": "不得保存 raw payload、不得渲染到前端或 LOGBOOK。",
      "instruction": "疑似含敏感 payload、raw log、未脫敏截圖或 private credential URL 時隔離。",
      "lane_id": "quarantine_sensitive_payload",
      "status": "reviewer_intake_lane_defined"
    },
    {
      "gate_effect": "不得建立 action button、不得轉成執行批准。",
      "instruction": "夾帶 repo / refs / workflow / runner / host / scan / runtime 執行要求時拒收。",
      "lane_id": "reject_execution_request",
      "status": "reviewer_intake_lane_defined"
    },
    {
      "gate_effect": "仍不是 accepted，也不是 runtime authorization。",
      "instruction": "欄位完整、證據脫敏、無敏感 payload 且無執行要求時才可進 reviewer checklist。",
      "lane_id": "ready_for_reviewer_validation",
      "status": "reviewer_intake_lane_defined"
    }
  ],
  "schema_version": "high_value_config_owner_packet_intake_preflight_v1",
  "source_false_flags": {
    "action_buttons_allowed": false,
    "active_scan_authorized": false,
    "dns_tls_change_authorized": false,
    "force_push_authorized": false,
    "host_write_authorized": false,
    "nginx_reload_authorized": false,
    "refs_sync_authorized": false,
    "request_sent": false,
    "response_accepted": false,
    "response_received": false,
    "runner_change_authorized": false,
    "runtime_execution_authorized": false,
    "secret_value_collection_allowed": false,
    "workflow_modification_authorized": false
  },
  "source_owner_packet_schema_version": "high_value_config_owner_packet_v1",
  "source_owner_packet_status": "draft_waiting_owner_response",
  "status": "request_dispatch_preflight_ready",
  "summary": {
    "accepted_response_count": 0,
    "action_button_count": 0,
    "blocked_request_count": 16,
    "c0_packet_count": 2,
    "c1_packet_count": 0,
    "canonical_owner_field_count": 9,
    "dispatch_preflight_check_count": 9,
    "packet_count": 3,
    "received_response_count": 0,
    "rejected_response_count": 0,
    "request_sent_count": 0,
    "required_owner_field_total": 27,
    "reviewer_intake_lane_count": 5,
    "reviewer_queue_write_count": 0,
    "runtime_gate_count": 0
  }
}
