{
  "schema_version": "kali_maintenance_window_draft_v1",
  "status": "draft_waiting_owner_review",
  "date": "2026-06-04",
  "mode": "maintenance_window_draft_only",
  "source_evidence_refs": [
    "docs/security/KALI-INTEGRATION-STATUS.md",
    "docs/security/kali-integration-status.snapshot.json",
    "docs/security/KALI-SCAN-SCOPE-APPROVAL-PACKAGE.md",
    "docs/security/DEV-HOSTS-112-111-168-OBSERVE-ONLY-MAPPING.md",
    "docs/workplans/2026-06-04-iwooos-security-governance-p0.md"
  ],
  "summary": {
    "host": "192.168.0.112",
    "asset_key": "host:kali-112",
    "pending_update_count": 1994,
    "failed_systemd_unit_count": 1,
    "service_hardening_enabled_count": 0,
    "service_hardening_expected_count": 4,
    "reboot_required": false,
    "maintenance_window_package_ready": true,
    "maintenance_window_completion_percent": 100,
    "maintenance_window_approved": false,
    "host_update_authorized": false,
    "service_restart_authorized": false,
    "hardening_authorized": false,
    "reboot_authorized": false,
    "active_scan_authorized": false,
    "execute_endpoint_authorized": false
  },
  "observed_gaps": [
    {
      "gap_id": "pending-updates-1994",
      "current_evidence": "2026-06-04 只讀快照顯示 upgradable_package_count=1994。",
      "risk": "MEDIUM",
      "required_before_action": [
        "maintenance window owner response",
        "package change scope",
        "rollback owner",
        "post-check owner",
        "reboot decision"
      ]
    },
    {
      "gap_id": "networking-service-failed",
      "current_evidence": "2026-06-04 只讀快照顯示 failed_systemd_unit_names=[networking.service]。",
      "risk": "MEDIUM",
      "required_before_action": [
        "service owner confirmation",
        "expected network manager / interface model",
        "restart impact review",
        "rollback path",
        "out-of-band access confirmation"
      ]
    },
    {
      "gap_id": "scanner-service-hardening-0-of-4",
      "current_evidence": "2026-06-04 只讀快照顯示 NoNewPrivileges、PrivateTmp、ProtectSystem、ProtectHome 尚未啟用。",
      "risk": "MEDIUM",
      "required_before_action": [
        "dry-run hardening design",
        "scanner tool compatibility review",
        "override rollback file plan",
        "health check plan",
        "manual approval"
      ]
    },
    {
      "gap_id": "execute-endpoint-present",
      "current_evidence": "Kali Scanner API 文件化存在 /execute path，仍是 block candidate。",
      "risk": "HIGH",
      "required_before_action": [
        "separate high-risk approval",
        "allowlist / disable gate design",
        "audit event design",
        "runtime gate",
        "manual exception record"
      ]
    }
  ],
  "owner_response_handoff": {
    "status": "ready_not_dispatched",
    "request_dispatch_authorized": false,
    "required_response_fields": [
      "owner_role_or_team",
      "maintenance_window_start_end_taipei",
      "change_scope",
      "rollback_owner",
      "validation_owner",
      "communication_owner",
      "reboot_decision",
      "redacted_evidence_refs",
      "followup_owner"
    ],
    "forbidden_inputs": [
      "password value",
      "token value",
      "private key",
      "API key value",
      "runner token",
      "raw secret",
      "command to execute",
      "apt upgrade request",
      "service restart request",
      "hardening apply request",
      "active scan request",
      "execute endpoint request"
    ],
    "response_received": false,
    "response_accepted": false
  },
  "maintenance_window_draft": {
    "window_status": "waiting_owner_selection",
    "candidate_window": "建議由 owner 指定台北時間低流量 2 小時窗口；本草案不自動指定日期或開始維護。",
    "change_lanes": [
      {
        "lane_id": "package-update-planning",
        "description": "整理 full-upgrade / autoremove / reboot 的人工批准前檢查，不執行 apt upgrade。",
        "authorization_required": "kali-full-upgrade-reboot approval + rollback owner + post-check owner",
        "current_authorized": false
      },
      {
        "lane_id": "networking-service-review",
        "description": "釐清 networking.service failed 是否為 expected / legacy / real failure，不直接 restart。",
        "authorization_required": "service owner decision + out-of-band access + rollback path",
        "current_authorized": false
      },
      {
        "lane_id": "scanner-systemd-hardening-dry-run-design",
        "description": "設計 kali-scanner.service hardening override 的 dry-run / compatibility review，不套用 hardening。",
        "authorization_required": "scanner owner decision + health compatibility review + rollback file plan",
        "current_authorized": false
      },
      {
        "lane_id": "post-maintenance-validation",
        "description": "定義維護後 scanner health、Docker service、failed units、pending updates、reboot required 與 AwoooP / IwoooS evidence readback。",
        "authorization_required": "validation owner + evidence refs + reviewer acceptance",
        "current_authorized": false
      }
    ],
    "pre_window_checks": [
      "確認 maintenance window owner response 已收到且 accepted。",
      "確認 package / service / hardening / reboot scope 沒有混在同一個未批准動作中。",
      "確認不保存任何 credential value。",
      "確認 rollback owner 與 validation owner 已指定。",
      "確認 out-of-band access 與停止條件已定義。",
      "確認 active scan、credentialed scan 與 /execute 仍未授權。"
    ]
  },
  "rollback_plan_draft": [
    {
      "rollback_item": "package update rollback",
      "required_evidence": [
        "pre-window package list snapshot ref",
        "apt history / dpkg log redacted ref",
        "rollback owner",
        "reboot decision"
      ],
      "owner_status": "waiting_owner_assignment"
    },
    {
      "rollback_item": "networking.service restart rollback",
      "required_evidence": [
        "current network service model",
        "out-of-band access confirmation",
        "previous service state snapshot ref",
        "rollback owner"
      ],
      "owner_status": "waiting_owner_assignment"
    },
    {
      "rollback_item": "systemd hardening override rollback",
      "required_evidence": [
        "override file path",
        "scanner tool compatibility result",
        "scanner health before / after refs",
        "rollback owner"
      ],
      "owner_status": "waiting_owner_assignment"
    }
  ],
  "post_check_plan": [
    "scanner API /health returns healthy",
    "kali-scanner.service active / enabled",
    "node-exporter container up",
    "wg-easy container healthy",
    "failed systemd units reviewed",
    "pending update count recorded",
    "reboot required flag recorded",
    "service hardening state recorded",
    "AwoooP / IwoooS evidence refs updated",
    "no active scan or /execute call occurred during maintenance unless separately approved"
  ],
  "acceptance_rules": [
    "本草案完成不代表 maintenance window 已批准。",
    "maintenance owner response received / accepted 前，不得執行 apt upgrade、restart、hardening 或 reboot。",
    "任何 active scan、credentialed scan 或 /execute 都必須走獨立 approval gate，不可包進維護窗口。",
    "所有 evidence refs 必須脫敏，不保存 credential value。",
    "維護後若任何 post-check 失敗，只能建立人工 follow-up，不得自動補救。"
  ],
  "forbidden_actions": [
    "apt_upgrade",
    "apt_full_upgrade",
    "apt_autoremove",
    "restart_networking_service",
    "apply_systemd_hardening",
    "reboot_host",
    "active_scan",
    "credentialed_scan",
    "call_execute_endpoint",
    "store_credential_value",
    "change_firewall",
    "change_networkpolicy",
    "change_rbac",
    "enable_runtime_blocking_control"
  ]
}
