{
  "evidence_slots": [
    {
      "accepted": true,
      "next_gate": "manager_registry_acceptance_evidence_review",
      "quarantined": false,
      "received": true,
      "required_fields": [
        "agent_total",
        "agent_active",
        "agent_disconnected",
        "agent_never_connected",
        "registry_export_summary_ref"
      ],
      "slot_id": "manager_registry_agent_counts",
      "title": "Manager registry agent counts"
    },
    {
      "accepted": true,
      "next_gate": "manager_registry_acceptance_evidence_review",
      "quarantined": false,
      "received": true,
      "required_fields": [
        "registry_export_scope_aliases",
        "per_host_registry_matrix",
        "registry_gap_reason_by_alias"
      ],
      "slot_id": "per_host_agent_scope_matrix",
      "title": "逐主機 agent scope matrix"
    },
    {
      "accepted": true,
      "next_gate": "manager_registry_acceptance_evidence_review",
      "quarantined": false,
      "received": true,
      "required_fields": [
        "dashboard_api_connection_check_status",
        "dashboard_api_version_check_status",
        "dashboard_index_pattern_statuses",
        "dashboard_api_degradation_root_cause",
        "dashboard_api_repair_postcheck_ref"
      ],
      "slot_id": "dashboard_api_rbac_tls_repair_readback",
      "title": "Dashboard API / RBAC / TLS 修復讀回"
    },
    {
      "accepted": true,
      "next_gate": "manager_registry_acceptance_evidence_review",
      "quarantined": false,
      "received": true,
      "required_fields": [
        "collection_method",
        "manager_health_ref",
        "redacted_evidence_refs"
      ],
      "slot_id": "readonly_credential_metadata_without_secret",
      "title": "唯讀 credential metadata，不含 secret"
    },
    {
      "accepted": true,
      "next_gate": "manager_registry_acceptance_evidence_review",
      "quarantined": false,
      "received": true,
      "required_fields": [
        "owner_role",
        "team",
        "decision",
        "decision_reason",
        "followup_owner",
        "rollback_owner"
      ],
      "slot_id": "owner_response_and_rollback_owner",
      "title": "Owner response / rollback owner"
    },
    {
      "accepted": true,
      "next_gate": "manager_registry_acceptance_evidence_review",
      "quarantined": false,
      "received": true,
      "required_fields": [
        "postcheck_plan",
        "redacted_evidence_refs"
      ],
      "slot_id": "post_enable_iwooos_readback",
      "title": "Post-enable IwoooS readback"
    }
  ],
  "execution_boundaries": {
    "agent_identity_public_display_allowed": false,
    "host_write_authorized": false,
    "internal_ip_public_display_allowed": false,
    "kali_active_scan_authorized": false,
    "not_authorization": true,
    "raw_wazuh_payload_storage_allowed": false,
    "runtime_execution_authorized": false,
    "secret_value_collection_allowed": false,
    "wazuh_active_response_authorized": false,
    "wazuh_agent_reenroll_authorized": false,
    "wazuh_agent_restart_authorized": false,
    "wazuh_api_live_query_authorized": false,
    "wazuh_manager_restart_authorized": false
  },
  "expected_scope_aliases": [
    "managed_core_node_a",
    "managed_core_node_b",
    "managed_dev_node_a",
    "managed_dev_node_b",
    "managed_control_node_a",
    "managed_control_node_b"
  ],
  "forbidden_actions": [
    "wazuh_api_live_query",
    "wazuh_agent_reenroll",
    "wazuh_agent_restart",
    "wazuh_manager_restart",
    "wazuh_active_response",
    "wazuh_dashboard_secret_patch",
    "host_write",
    "firewall_change",
    "nginx_reload",
    "k8s_or_argocd_change",
    "kali_active_scan"
  ],
  "forbidden_payloads": [
    "raw_wazuh_payload",
    "raw_log",
    "full_journal",
    "full_cli_output",
    "unredacted_screenshot",
    "agent_name",
    "agent_id_plaintext",
    "internal_ip",
    "hostname",
    "authorization_header",
    "bearer_token",
    "basic_auth",
    "password",
    "token",
    "cookie",
    "private_key",
    "client_keys",
    "raw_dashboard_request",
    "dashboard_api_secret",
    "stored_api_password",
    "api_token",
    "active_response_enable",
    "agent_reenroll",
    "agent_restart",
    "host_write",
    "firewall_change",
    "nginx_reload"
  ],
  "generated_at": "2026-06-27T15:24:00+08:00",
  "mode": "committed_manager_registry_accepted_readback_no_runtime_no_secret_collection",
  "no_false_green_rules": [
    "reviewer validation passed 只代表脫敏 owner export refs 通過 no-persist 驗證。",
    "post-enable IwoooS readback passed 只代表 production API / 前台已讀回 reviewer passed，不代表 live Wazuh 查詢或 runtime action。",
    "manager registry accepted readback 只代表 6 個公開別名的脫敏 evidence 已通過 committed review，不代表 runtime gate 已開。",
    "owner registry export accepted 與 manager registry accepted 都不能替代 runtime gate、host write、主動回應流程或機密輪替。",
    "Dashboard 可見、index pattern 三綠勾、HTTP 200 或 transport observed 不可替代 manager registry counts。",
    "reviewer accepted 只可更新只讀 posture；active response、agent restart、reenroll、host write、secret rotation 或掃描仍需獨立 runtime gate。"
  ],
  "outcome_lanes": [
    "waiting_owner_registry_export",
    "request_missing_fields",
    "request_counts_arithmetic_fix",
    "request_alias_scope_parity_fix",
    "request_per_host_matrix_supplement",
    "request_dashboard_api_repair_postcheck",
    "request_readonly_credential_metadata",
    "request_owner_accountability_supplement",
    "quarantine_sensitive_payload",
    "reject_runtime_action_request",
    "ready_for_reviewer_validation",
    "accepted_for_readonly_posture_only",
    "post_enable_iwooos_readback_passed",
    "manager_registry_acceptance_evidence_review",
    "manager_registry_acceptance_evidence_intake_ready",
    "accepted_for_manager_registry_acceptance_review_only",
    "commit_manager_registry_accepted_readback_evidence"
  ],
  "per_host_required_fields": [
    "node_alias",
    "scope_role",
    "registry_presence",
    "agent_status_bucket",
    "last_seen_state",
    "manager_group_ref",
    "agent_id_redacted_ref",
    "gap_reason",
    "redacted_evidence_ref"
  ],
  "required_owner_fields": [
    "owner_role",
    "team",
    "decision",
    "decision_reason",
    "affected_scope",
    "collection_method",
    "agent_total",
    "agent_active",
    "agent_disconnected",
    "agent_never_connected",
    "last_seen_window_start",
    "last_seen_window_end",
    "registry_collected_at",
    "registry_export_scope_aliases",
    "per_host_registry_matrix",
    "registry_gap_reason_by_alias",
    "registry_export_summary_ref",
    "manager_health_ref",
    "dashboard_api_status_ref",
    "dashboard_api_connection_check_status",
    "dashboard_api_version_check_status",
    "dashboard_index_pattern_statuses",
    "dashboard_api_degradation_root_cause",
    "dashboard_api_repair_postcheck_ref",
    "redacted_evidence_refs",
    "followup_owner",
    "rollback_owner",
    "postcheck_plan"
  ],
  "reviewer_validation_checks": [
    {
      "check_id": "RV-01",
      "failure_lane": "request_missing_fields",
      "required_evidence": "owner_role、team、decision、decision_reason、affected_scope、collection_method 與 redacted evidence refs 必須存在。",
      "title": "Export envelope 欄位齊全"
    },
    {
      "check_id": "RV-02",
      "failure_lane": "request_counts_arithmetic_fix",
      "required_evidence": "agent_total 不得小於 active + disconnected + never_connected，且需有 registry_export_summary_ref。",
      "title": "Registry counts 算術一致"
    },
    {
      "check_id": "RV-03",
      "failure_lane": "request_alias_scope_parity_fix",
      "required_evidence": "registry_export_scope_aliases 必須剛好覆蓋 6 個公開別名，不得加入真實主機名或內網識別。",
      "title": "Alias scope 與 IwoooS 覆蓋矩陣一致"
    },
    {
      "check_id": "RV-04",
      "failure_lane": "request_per_host_matrix_supplement",
      "required_evidence": "每個公開節點別名都要有 9 個 per-host 欄位與 gap reason。",
      "title": "逐主機矩陣欄位完整"
    },
    {
      "check_id": "RV-05",
      "failure_lane": "request_dashboard_api_repair_postcheck",
      "required_evidence": "API connection、API version、index pattern、degradation root cause 與 repair postcheck 需分欄。",
      "title": "Dashboard API 狀態不可用 index pattern 代替"
    },
    {
      "check_id": "RV-06",
      "failure_lane": "request_readonly_credential_metadata",
      "required_evidence": "manager_health_ref 與 readonly credential metadata 只能是脫敏來源資訊，不得含 secret value。",
      "title": "Manager health 與 readonly credential metadata 可追溯"
    },
    {
      "check_id": "RV-07",
      "failure_lane": "quarantine_sensitive_payload",
      "required_evidence": "不得含 raw Wazuh payload、完整 CLI output、未脫敏截圖、agent 原名、內網位址、token、密碼或 client key。",
      "title": "Forbidden payload 一律隔離"
    },
    {
      "check_id": "RV-08",
      "failure_lane": "request_owner_accountability_supplement",
      "required_evidence": "followup_owner、rollback_owner、維護窗口與 postcheck plan 必須能被 reviewer 追蹤。",
      "title": "Owner / followup / rollback 責任可讀"
    },
    {
      "check_id": "RV-09",
      "failure_lane": "reject_runtime_action_request",
      "required_evidence": "owner decision 不可夾帶 active response、agent restart、reenroll、host write、Nginx、firewall、K8s 或 secret rotation。",
      "title": "收件不等於 runtime 授權"
    },
    {
      "check_id": "RV-10",
      "failure_lane": "post_enable_iwooos_readback_passed_no_runtime",
      "required_evidence": "production API 與前台 smoke 已讀回 reviewer passed；此讀回只更新 read-only posture，不查 live Wazuh、不保存 raw payload、不開 runtime gate。",
      "title": "Post-enable IwoooS readback 已讀回但不開 runtime"
    },
    {
      "check_id": "RV-11",
      "failure_lane": "waiting_manager_registry_acceptance_evidence",
      "required_evidence": "新增 no-persist acceptance evidence validator；reviewer packet 與 acceptance evidence 通過後才可進 committed readback，runtime gate 仍維持 0。",
      "title": "Manager registry acceptance evidence 可收件但不自動上修"
    }
  ],
  "schema_version": "wazuh_manager_registry_reviewer_validation_v1",
  "scope": "wazuh_manager_registry_owner_export_reviewer_validation",
  "source_refs": [
    "docs/security/wazuh-agent-visibility-owner-evidence-preflight.snapshot.json",
    "docs/security/wazuh-managed-host-coverage-gate.snapshot.json"
  ],
  "status": "manager_registry_accepted_readback_committed_no_runtime_no_secret_collection",
  "summary": {
    "active_response_authorized_count": 0,
    "evidence_slot_count": 6,
    "expected_scope_alias_count": 6,
    "forbidden_action_count": 11,
    "forbidden_payload_count": 27,
    "host_write_authorized_count": 0,
    "manager_registry_acceptance_evidence_received_count": 1,
    "manager_registry_acceptance_evidence_review_ready_count": 1,
    "manager_registry_acceptance_intake_endpoint_available_count": 1,
    "manager_registry_accepted_count": 6,
    "outcome_lane_count": 17,
    "owner_registry_export_accepted_count": 1,
    "owner_registry_export_received_count": 1,
    "per_host_required_field_count": 9,
    "post_enable_readback_passed_count": 1,
    "required_owner_field_count": 28,
    "reviewer_validation_check_count": 11,
    "reviewer_validation_failed_count": 0,
    "reviewer_validation_passed_count": 1,
    "reviewer_validation_quarantined_count": 0,
    "reviewer_validation_ready_count": 1,
    "runtime_gate_count": 0,
    "secret_value_collection_allowed_count": 0
  }
}
