{
  "execution_boundaries": {
    "agent_identity_public_display_allowed": false,
    "force_push_allowed": false,
    "host_read_authorized": false,
    "host_write_authorized": false,
    "internal_ip_public_display_allowed": false,
    "kali_active_scan_authorized": false,
    "not_authorization": true,
    "production_deploy_authorized": false,
    "raw_wazuh_payload_storage_allowed": false,
    "runtime_execution_authorized": false,
    "secret_value_collection_allowed": false,
    "wazuh_active_response_authorized": false,
    "wazuh_api_live_query_authorized": false
  },
  "generated_at": "2026-06-24T22:48:00+08:00",
  "missing_required_source_paths": [],
  "mode": "repo_release_gate_no_runtime_no_secret_collection",
  "operator_interpretation": [
    "此 gate 通過不代表 production 已部署，只代表 source-side Wazuh read-only API 與 guard 可交接。",
    "正式 release 前不得用 predeploy 404 當成功，也不得為了修 404 直接改 Nginx、Docker、K8s、firewall 或 Wazuh secret。",
    "乾淨套用 proof 通過只代表 release patch 可落在最新主線，不代表已 push、已部署或已啟用 Wazuh live metadata。",
    "live Wazuh metadata query 必須另走 owner gate 與 server-side env；active response、host write、Kali active scan 仍為 0 / false。"
  ],
  "release_gates": [
    {
      "gate_id": "source_side_fastapi_route",
      "required_evidence": "FastAPI /api/iwooos/wazuh 與 /api/v1/iwooos/wazuh source path present",
      "runtime_authorized": false,
      "status": "passed"
    },
    {
      "gate_id": "source_boundary_guard",
      "required_evidence": "wazuh-readonly-route-boundary-guard.py 通過",
      "runtime_authorized": false,
      "status": "passed"
    },
    {
      "gate_id": "production_readback_script",
      "required_evidence": "wazuh-readonly-production-readback.py 可在 release 後不接受 404",
      "runtime_authorized": false,
      "status": "passed"
    },
    {
      "gate_id": "release_patch_apply_proof",
      "required_evidence": "同等 patch 已可乾淨套用到最新 gitea/main 並通過同組 guard",
      "runtime_authorized": false,
      "status": "passed"
    },
    {
      "gate_id": "gitea_branch_push",
      "required_evidence": "具備正式權限的 lane 推送或合併 codex/iwooos-wazuh-boundary-guard-20260624",
      "runtime_authorized": false,
      "status": "blocked_credential_required"
    },
    {
      "gate_id": "production_deploy",
      "required_evidence": "Gitea CD / deploy marker 指向已合併 Wazuh fix 的 commit",
      "runtime_authorized": false,
      "status": "blocked_waiting_release_lane"
    },
    {
      "gate_id": "production_readback",
      "required_evidence": "python3 scripts/security/wazuh-readonly-production-readback.py --json 通過且不回 404",
      "runtime_authorized": false,
      "status": "blocked_waiting_deploy"
    },
    {
      "gate_id": "wazuh_live_metadata_env",
      "required_evidence": "server-side env 與 owner gate；不得硬編 secret",
      "runtime_authorized": false,
      "status": "blocked_owner_gate_required"
    }
  ],
  "release_lane_evidence": {
    "apply_check_status": "passed_external_readback_required_after_final_commit",
    "base_commit_readback": "run git rev-parse gitea/main before release; do not hardcode a moving main commit",
    "base_ref": "gitea/main",
    "gitea_push_blocker": "https_noninteractive_credential_required",
    "production_readback_status": "predeploy_404_observed",
    "release_patch_set_readback": "generate with git format-patch gitea/main..HEAD after the final docs commit, then record sha256 outside the committed file",
    "source_branch": "codex/iwooos-wazuh-boundary-guard-20260624",
    "source_fix_commit_readback": "run git log --oneline gitea/main..HEAD before release; do not hardcode a rebase-sensitive commit hash",
    "source_head_readback": "run git rev-parse HEAD after the final docs commit; do not hardcode a self-referential commit hash"
  },
  "required_source_paths": [
    "apps/api/src/api/v1/iwooos.py",
    "apps/api/tests/test_iwooos_wazuh_api.py",
    "apps/web/src/app/api/iwooos/wazuh/route.ts",
    "docs/security/IWOOOS-WAZUH-READONLY-API-RELEASE-HANDOFF.md",
    "scripts/security/wazuh-readonly-production-readback.py",
    "scripts/security/wazuh-readonly-route-boundary-guard.py"
  ],
  "schema_version": "iwooos_wazuh_readonly_release_gate_v1",
  "status": "blocked_waiting_gitea_push_and_production_deploy",
  "summary": {
    "active_response_authorized_count": 0,
    "gitea_push_blocker_observed_count": 1,
    "gitea_push_complete_count": 0,
    "host_forensics_ref_accepted_count": 0,
    "host_write_authorized_count": 0,
    "missing_required_source_path_count": 0,
    "predeploy_404_observed_count": 1,
    "production_deploy_complete_count": 0,
    "production_readback_passed_count": 0,
    "production_readback_script_complete_count": 1,
    "release_handoff_complete_count": 1,
    "release_patch_apply_proof_complete_count": 1,
    "route_boundary_guard_complete_count": 1,
    "runtime_gate_count": 0,
    "source_side_fix_complete_count": 1,
    "wazuh_event_ref_accepted_count": 0,
    "wazuh_server_side_env_enabled_count": 0
  }
}