{
  "execution_boundaries": {
    "action_buttons_allowed": false,
    "certbot_renew_authorized": false,
    "dns_query_executed": false,
    "host_live_conf_read_authorized": false,
    "live_tls_probe_executed": false,
    "nginx_reload_authorized": false,
    "nginx_reload_executed": false,
    "nginx_test_authorized": false,
    "nginx_test_executed": false,
    "not_authorization": true,
    "production_write_authorized": false,
    "raw_live_conf_storage_allowed": false,
    "recipient_confirmed": false,
    "redacted_export_received": false,
    "rendered_diff_authorized": false,
    "request_sent": false,
    "route_smoke_authorized": false,
    "route_smoke_executed": false,
    "runtime_execution_authorized": false,
    "secret_value_collection_allowed": false,
    "ssh_read_authorized": false
  },
  "generated_at": "2026-06-14T19:35:00+08:00",
  "git_commit": "5068654d",
  "intake_candidates": [
    {
      "accepted_redacted_export": false,
      "action_buttons_allowed": false,
      "config_id": "host188_all_sites",
      "control_tier": "C0",
      "export_request_id": "public_gateway_live_conf_export:host188_all_sites",
      "host": "192.168.0.188",
      "intake_fields": [
        "intake_id",
        "export_request_id",
        "config_id",
        "control_tier",
        "redacted_live_conf_ref",
        "ref_owner_role_or_team",
        "received_metadata_ref",
        "sensitive_payload_review",
        "quarantine_ref",
        "rendered_diff_candidate_ref",
        "not_approval"
      ],
      "intake_id": "public_gateway_redacted_export_intake:host188_all_sites",
      "live_path": "/etc/nginx/sites-enabled/all-sites.conf",
      "nginx_reload_authorized": false,
      "nginx_test_authorized": false,
      "nginx_test_executed": false,
      "not_approval": true,
      "owner_gate": "public_gateway_owner_response_required",
      "production_write_authorized": false,
      "quarantine_ref": null,
      "quarantine_written": false,
      "raw_live_conf_stored": false,
      "received_metadata_ref": null,
      "recipient_confirmed": false,
      "redacted_export_received": false,
      "redacted_live_conf_ref": null,
      "redaction_policy_ref": "docs/security/PUBLIC-GATEWAY-LIVE-CONF-EXPORT-REQUEST.md#3-redaction-policy",
      "ref_owner_role_or_team": "pending_owner_role_or_team",
      "rejected_intake": false,
      "rejection_guards": [
        "raw_live_conf_payload",
        "tls_private_key",
        "token_secret_cookie_session",
        "authorization_header_or_basic_auth",
        "unredacted_upstream_credential",
        "db_url_or_env_dump",
        "shell_history_or_private_key",
        "unredacted_log_or_screenshot",
        "nginx_test_execution_request",
        "nginx_reload_or_route_change_request",
        "dns_tls_certbot_request",
        "ssh_host_write_or_runtime_request"
      ],
      "rendered_diff_authorized": false,
      "rendered_diff_candidate": false,
      "rendered_diff_candidate_ref": null,
      "request_sent": false,
      "reviewer_intake_lanes": [
        "keep_waiting_redacted_export",
        "request_more_metadata",
        "quarantine_sensitive_payload",
        "reject_execution_request",
        "ready_for_rendered_diff_preflight"
      ],
      "role": "public_gateway_all_sites",
      "route_smoke_authorized": false,
      "route_smoke_executed": false,
      "runtime_gate": false,
      "secret_value_collection_allowed": false,
      "sensitive_payload_review": "not_started",
      "source_snapshot_ref": "docs/security/public-gateway-live-conf-export-request.snapshot.json",
      "status": "waiting_redacted_export_ref",
      "validation_checks": [
        "source_export_request_snapshot_current",
        "request_sent_metadata_required",
        "recipient_confirmed_metadata_required",
        "redacted_export_ref_required",
        "raw_live_conf_payload_blocked",
        "redaction_policy_attestation_required",
        "secret_marker_scan_required",
        "scope_matches_export_request",
        "quarantine_before_storage",
        "rendered_diff_gate_separate"
      ]
    },
    {
      "accepted_redacted_export": false,
      "action_buttons_allowed": false,
      "config_id": "host188_internal_tools_https",
      "control_tier": "C0",
      "export_request_id": "public_gateway_live_conf_export:host188_internal_tools_https",
      "host": "192.168.0.188",
      "intake_fields": [
        "intake_id",
        "export_request_id",
        "config_id",
        "control_tier",
        "redacted_live_conf_ref",
        "ref_owner_role_or_team",
        "received_metadata_ref",
        "sensitive_payload_review",
        "quarantine_ref",
        "rendered_diff_candidate_ref",
        "not_approval"
      ],
      "intake_id": "public_gateway_redacted_export_intake:host188_internal_tools_https",
      "live_path": "owner_confirmation_required",
      "nginx_reload_authorized": false,
      "nginx_test_authorized": false,
      "nginx_test_executed": false,
      "not_approval": true,
      "owner_gate": "public_tools_owner_response_required",
      "production_write_authorized": false,
      "quarantine_ref": null,
      "quarantine_written": false,
      "raw_live_conf_stored": false,
      "received_metadata_ref": null,
      "recipient_confirmed": false,
      "redacted_export_received": false,
      "redacted_live_conf_ref": null,
      "redaction_policy_ref": "docs/security/PUBLIC-GATEWAY-LIVE-CONF-EXPORT-REQUEST.md#3-redaction-policy",
      "ref_owner_role_or_team": "pending_owner_role_or_team",
      "rejected_intake": false,
      "rejection_guards": [
        "raw_live_conf_payload",
        "tls_private_key",
        "token_secret_cookie_session",
        "authorization_header_or_basic_auth",
        "unredacted_upstream_credential",
        "db_url_or_env_dump",
        "shell_history_or_private_key",
        "unredacted_log_or_screenshot",
        "nginx_test_execution_request",
        "nginx_reload_or_route_change_request",
        "dns_tls_certbot_request",
        "ssh_host_write_or_runtime_request"
      ],
      "rendered_diff_authorized": false,
      "rendered_diff_candidate": false,
      "rendered_diff_candidate_ref": null,
      "request_sent": false,
      "reviewer_intake_lanes": [
        "keep_waiting_redacted_export",
        "request_more_metadata",
        "quarantine_sensitive_payload",
        "reject_execution_request",
        "ready_for_rendered_diff_preflight"
      ],
      "role": "public_internal_tools_https",
      "route_smoke_authorized": false,
      "route_smoke_executed": false,
      "runtime_gate": false,
      "secret_value_collection_allowed": false,
      "sensitive_payload_review": "not_started",
      "source_snapshot_ref": "docs/security/public-gateway-live-conf-export-request.snapshot.json",
      "status": "waiting_redacted_export_ref",
      "validation_checks": [
        "source_export_request_snapshot_current",
        "request_sent_metadata_required",
        "recipient_confirmed_metadata_required",
        "redacted_export_ref_required",
        "raw_live_conf_payload_blocked",
        "redaction_policy_attestation_required",
        "secret_marker_scan_required",
        "scope_matches_export_request",
        "quarantine_before_storage",
        "rendered_diff_gate_separate"
      ]
    },
    {
      "accepted_redacted_export": false,
      "action_buttons_allowed": false,
      "config_id": "host110_ollama_proxy",
      "control_tier": "C1",
      "export_request_id": "public_gateway_live_conf_export:host110_ollama_proxy",
      "host": "192.168.0.110",
      "intake_fields": [
        "intake_id",
        "export_request_id",
        "config_id",
        "control_tier",
        "redacted_live_conf_ref",
        "ref_owner_role_or_team",
        "received_metadata_ref",
        "sensitive_payload_review",
        "quarantine_ref",
        "rendered_diff_candidate_ref",
        "not_approval"
      ],
      "intake_id": "public_gateway_redacted_export_intake:host110_ollama_proxy",
      "live_path": "/etc/nginx/sites-enabled/110-ollama-proxy.conf",
      "nginx_reload_authorized": false,
      "nginx_test_authorized": false,
      "nginx_test_executed": false,
      "not_approval": true,
      "owner_gate": "ai_provider_proxy_owner_response_required",
      "production_write_authorized": false,
      "quarantine_ref": null,
      "quarantine_written": false,
      "raw_live_conf_stored": false,
      "received_metadata_ref": null,
      "recipient_confirmed": false,
      "redacted_export_received": false,
      "redacted_live_conf_ref": null,
      "redaction_policy_ref": "docs/security/PUBLIC-GATEWAY-LIVE-CONF-EXPORT-REQUEST.md#3-redaction-policy",
      "ref_owner_role_or_team": "pending_owner_role_or_team",
      "rejected_intake": false,
      "rejection_guards": [
        "raw_live_conf_payload",
        "tls_private_key",
        "token_secret_cookie_session",
        "authorization_header_or_basic_auth",
        "unredacted_upstream_credential",
        "db_url_or_env_dump",
        "shell_history_or_private_key",
        "unredacted_log_or_screenshot",
        "nginx_test_execution_request",
        "nginx_reload_or_route_change_request",
        "dns_tls_certbot_request",
        "ssh_host_write_or_runtime_request"
      ],
      "rendered_diff_authorized": false,
      "rendered_diff_candidate": false,
      "rendered_diff_candidate_ref": null,
      "request_sent": false,
      "reviewer_intake_lanes": [
        "keep_waiting_redacted_export",
        "request_more_metadata",
        "quarantine_sensitive_payload",
        "reject_execution_request",
        "ready_for_rendered_diff_preflight"
      ],
      "role": "ollama_proxy_gateway",
      "route_smoke_authorized": false,
      "route_smoke_executed": false,
      "runtime_gate": false,
      "secret_value_collection_allowed": false,
      "sensitive_payload_review": "not_started",
      "source_snapshot_ref": "docs/security/public-gateway-live-conf-export-request.snapshot.json",
      "status": "waiting_redacted_export_ref",
      "validation_checks": [
        "source_export_request_snapshot_current",
        "request_sent_metadata_required",
        "recipient_confirmed_metadata_required",
        "redacted_export_ref_required",
        "raw_live_conf_payload_blocked",
        "redaction_policy_attestation_required",
        "secret_marker_scan_required",
        "scope_matches_export_request",
        "quarantine_before_storage",
        "rendered_diff_gate_separate"
      ]
    }
  ],
  "intake_fields": [
    "intake_id",
    "export_request_id",
    "config_id",
    "control_tier",
    "redacted_live_conf_ref",
    "ref_owner_role_or_team",
    "received_metadata_ref",
    "sensitive_payload_review",
    "quarantine_ref",
    "rendered_diff_candidate_ref",
    "not_approval"
  ],
  "next_steps": [
    "只有收到可稽核 request sent metadata 與 owner-provided redacted export ref 後，才能另建收件紀錄。",
    "任何疑似 raw conf 或 sensitive payload 必須先 quarantine，不得寫入 repo、LOGBOOK 或前端。",
    "收件通過後仍只能進 rendered diff preflight；nginx -t、reload、route smoke 需另行人工批准。"
  ],
  "rejection_guards": [
    "raw_live_conf_payload",
    "tls_private_key",
    "token_secret_cookie_session",
    "authorization_header_or_basic_auth",
    "unredacted_upstream_credential",
    "db_url_or_env_dump",
    "shell_history_or_private_key",
    "unredacted_log_or_screenshot",
    "nginx_test_execution_request",
    "nginx_reload_or_route_change_request",
    "dns_tls_certbot_request",
    "ssh_host_write_or_runtime_request"
  ],
  "reviewer_intake_lanes": [
    {
      "gate_effect": "request_sent / received / accepted / rendered diff / runtime gate 全部維持 0。",
      "instruction": "尚未送件、尚未確認 recipient 或尚未收到脫敏 export ref 時維持等待。",
      "lane_id": "keep_waiting_redacted_export",
      "status": "redacted_export_intake_lane_defined"
    },
    {
      "gate_effect": "不得保存 raw payload，不得增加 accepted。",
      "instruction": "缺 owner role、received metadata ref、scope 對應、redaction attestation 或 followup owner 時補件。",
      "lane_id": "request_more_metadata",
      "status": "redacted_export_intake_lane_defined"
    },
    {
      "gate_effect": "只可留下 quarantine metadata，不得寫入 repo、LOGBOOK 或前端。",
      "instruction": "疑似含敏感 payload、raw conf、未脫敏 log 或 credential URL 時隔離。",
      "lane_id": "quarantine_sensitive_payload",
      "status": "redacted_export_intake_lane_defined"
    },
    {
      "gate_effect": "不得轉成 action button 或 runtime approval。",
      "instruction": "夾帶 nginx -t、reload、route smoke、DNS / TLS、certbot、SSH 或 host write 要求時拒收。",
      "lane_id": "reject_execution_request",
      "status": "redacted_export_intake_lane_defined"
    },
    {
      "gate_effect": "仍不是 rendered diff ready，也不是 nginx / route / runtime 授權。",
      "instruction": "欄位完整、只有脫敏 ref、無敏感 payload 且無執行要求時，才可進 rendered diff preflight。",
      "lane_id": "ready_for_rendered_diff_preflight",
      "status": "redacted_export_intake_lane_defined"
    }
  ],
  "schema_version": "public_gateway_redacted_export_intake_preflight_v1",
  "source_export_request_schema_version": "public_gateway_live_conf_export_request_v1",
  "source_export_request_status": "live_conf_export_request_ready_not_dispatched",
  "status": "redacted_export_intake_preflight_ready_no_payload_received",
  "summary": {
    "accepted_redacted_export_count": 0,
    "action_button_count": 0,
    "c0_intake_candidate_count": 2,
    "c1_intake_candidate_count": 1,
    "intake_candidate_count": 3,
    "intake_field_count": 11,
    "nginx_reload_authorized_count": 0,
    "nginx_test_authorized_count": 0,
    "nginx_test_executed_count": 0,
    "quarantined_payload_count": 0,
    "raw_live_conf_stored_count": 0,
    "recipient_confirmed_count": 0,
    "redacted_export_received_count": 0,
    "rejected_intake_count": 0,
    "rejection_guard_count": 12,
    "rendered_diff_candidate_count": 0,
    "request_sent_count": 0,
    "reviewer_intake_lane_count": 5,
    "route_smoke_authorized_count": 0,
    "route_smoke_executed_count": 0,
    "runtime_gate_count": 0,
    "validation_check_count": 10
  },
  "validation_checks": [
    {
      "check_id": "source_export_request_snapshot_current",
      "gate_effect": "不增加 received / accepted / rendered diff / runtime gate。",
      "instruction": "來源匯出請求 snapshot 必須是 committed 最新版本。",
      "required": true,
      "status": "required_before_redacted_export_intake"
    },
    {
      "check_id": "request_sent_metadata_required",
      "gate_effect": "不增加 received / accepted / rendered diff / runtime gate。",
      "instruction": "沒有可稽核 request sent metadata 時，不得標記 received。",
      "required": true,
      "status": "required_before_redacted_export_intake"
    },
    {
      "check_id": "recipient_confirmed_metadata_required",
      "gate_effect": "不增加 received / accepted / rendered diff / runtime gate。",
      "instruction": "沒有 owner / recipient role 確認時，不得標記 recipient confirmed。",
      "required": true,
      "status": "required_before_redacted_export_intake"
    },
    {
      "check_id": "redacted_export_ref_required",
      "gate_effect": "不增加 received / accepted / rendered diff / runtime gate。",
      "instruction": "只接受脫敏 export ref；不得貼 raw live conf 內容。",
      "required": true,
      "status": "required_before_redacted_export_intake"
    },
    {
      "check_id": "raw_live_conf_payload_blocked",
      "gate_effect": "不增加 received / accepted / rendered diff / runtime gate。",
      "instruction": "若內容含完整 live conf、私鑰、token、cookie、session 或 authorization header，必須拒收或隔離。",
      "required": true,
      "status": "required_before_redacted_export_intake"
    },
    {
      "check_id": "redaction_policy_attestation_required",
      "gate_effect": "不增加 received / accepted / rendered diff / runtime gate。",
      "instruction": "owner 需聲明已依 redaction policy 處理 upstream credential、secret path 與敏感 payload。",
      "required": true,
      "status": "required_before_redacted_export_intake"
    },
    {
      "check_id": "secret_marker_scan_required",
      "gate_effect": "不增加 received / accepted / rendered diff / runtime gate。",
      "instruction": "任何可存入 repo 的 metadata 必須先通過 secret marker / sensitive marker 檢查。",
      "required": true,
      "status": "required_before_redacted_export_intake"
    },
    {
      "check_id": "scope_matches_export_request",
      "gate_effect": "不增加 received / accepted / rendered diff / runtime gate。",
      "instruction": "host、config_id、live path metadata 必須與匯出請求一致；不一致先補件。",
      "required": true,
      "status": "required_before_redacted_export_intake"
    },
    {
      "check_id": "quarantine_before_storage",
      "gate_effect": "不增加 received / accepted / rendered diff / runtime gate。",
      "instruction": "疑似敏感 payload 只可留下 quarantine metadata，不得寫入 LOGBOOK、前端或 repo artifact。",
      "required": true,
      "status": "required_before_redacted_export_intake"
    },
    {
      "check_id": "rendered_diff_gate_separate",
      "gate_effect": "不增加 received / accepted / rendered diff / runtime gate。",
      "instruction": "收件通過只代表可進 rendered diff preflight，不授權 nginx -t、reload 或 route smoke。",
      "required": true,
      "status": "required_before_redacted_export_intake"
    }
  ]
}
