{
  "allowed_release_methods": [
    "formal_gitea_merge",
    "formal_patch_apply",
    "maintainer_local_push_with_safe_credential"
  ],
  "blocked_actions": [
    "plain_text_gitea_token_in_remote_url",
    "copy_token_from_dirty_workspace",
    "force_push",
    "nginx_or_gateway_workaround_for_404",
    "docker_restart_for_wazuh_route",
    "k8s_or_argocd_manual_apply_for_wazuh_route",
    "firewall_change_for_wazuh_route",
    "wazuh_secret_or_manager_change_for_api_404",
    "enable_wazuh_live_metadata_without_owner_gate",
    "enable_wazuh_active_response",
    "host_write_or_kali_active_scan"
  ],
  "execution_boundaries": {
    "force_push_allowed": false,
    "host_write_authorized": false,
    "kali_active_scan_authorized": false,
    "not_authorization": true,
    "plain_text_token_workaround_allowed": false,
    "production_deploy_authorized": false,
    "repo_write_authorized": false,
    "runtime_execution_authorized": false,
    "secret_value_collection_allowed": false,
    "wazuh_active_response_authorized": false,
    "wazuh_api_live_query_authorized": false
  },
  "generated_at": "2026-06-24T22:48:00+08:00",
  "mode": "repo_preflight_no_secret_no_runtime_no_push",
  "operator_interpretation": [
    "此 preflight 通過前，不得把 Gitea credential blocker 視為可繞過。",
    "正式 release 可以選 formal merge、formal patch apply 或安全 credential push，但都需要 owner response 與 deploy 後 readback。",
    "不得用 Nginx、Docker、K8s、firewall、Wazuh secret 或主機重啟來修 public API 404。",
    "Wazuh live metadata 查詢與 active response 是不同 gate；本 preflight 不授權任何 runtime action。"
  ],
  "post_deploy_readback": {
    "command": "python3 scripts/security/wazuh-readonly-production-readback.py --json",
    "must_not_return_http_404": true,
    "required": true,
    "runtime_gate_expected": 0
  },
  "release_lanes": [
    {
      "lane_id": "formal_gitea_merge",
      "meaning": "由具備正式 Gitea 權限者合併 Wazuh 分支；不得 force push。",
      "runtime_authorized": false,
      "status": "blocked_owner_response_required"
    },
    {
      "lane_id": "formal_patch_apply",
      "meaning": "由正式 release lane 套用已驗證 patch set；不得跳過 production readback。",
      "runtime_authorized": false,
      "status": "blocked_owner_response_required"
    },
    {
      "lane_id": "maintainer_local_push_with_safe_credential",
      "meaning": "只接受安全的 credential helper / SSH key / 正式 release token；不得使用明文 token workaround。",
      "runtime_authorized": false,
      "status": "blocked_safe_credential_required"
    }
  ],
  "required_ack_flags": [
    "approve_formal_release_lane",
    "confirm_no_plaintext_token_workaround",
    "confirm_no_force_push",
    "confirm_no_runtime_workaround",
    "confirm_production_readback_after_deploy",
    "confirm_wazuh_live_metadata_requires_separate_owner_gate"
  ],
  "required_evidence_fields": [
    "release_lane_owner",
    "release_method",
    "target_branch_or_patch_set",
    "post_deploy_readback_command",
    "rollback_owner",
    "blocked_runtime_actions_ack"
  ],
  "schema_version": "iwooos_wazuh_readonly_release_lane_preflight_v1",
  "status": "blocked_waiting_formal_release_lane_owner_response",
  "summary": {
    "accepted_ack_flag_count": 0,
    "accepted_evidence_field_count": 0,
    "allowed_release_method_count": 3,
    "force_push_allowed_count": 0,
    "formal_release_lane_ready_count": 0,
    "gitea_push_authorized_count": 0,
    "patch_apply_authorized_count": 0,
    "plain_text_token_workaround_allowed_count": 0,
    "production_deploy_authorized_count": 0,
    "production_readback_passed_count": 0,
    "production_readback_required_count": 1,
    "required_ack_flag_count": 6,
    "required_evidence_field_count": 6,
    "runtime_gate_count": 0,
    "runtime_workaround_allowed_count": 0,
    "safe_credential_available_count": 0,
    "wazuh_live_metadata_owner_gate_ready_count": 0
  }
}