{ "contract_id": "execution_observable_contract_registry", "version": "v1", "created_at": "2026-06-29T21:32:30-03:00", "status": "PASS", "known_actions": { "TARGET_PROBE": { "status": "CONTRACTED", "execution_class": "READ_ONLY", "remote_mutation_allowed": "NO", "installation_command_allowed": "NO", "expected_evidence": [ "REMOTE_HOSTNAME", "REMOTE_WHOAMI", "REMOTE_OS_PRETTY", "REMOTE_KERNEL", "OPT_YEFFAI_EXISTS", "TARGET_PROBE_STATUS", "REMOTE_MUTATION_EXECUTED", "INSTALLATION_COMMAND_EXECUTED" ], "canon_outputs": [ "yeffai_target_probe_latest.json", "yeffai_target_live_runtime.json", "yeffai_target_operational_scan.json", "yeffai_bootstrap_jobs.json", "execution_ledger.json", "execution_ledger.jsonl" ], "runtime_fields": [ "target_pull_worker_status", "target_scan_status", "next_required_action" ] }, "BEGIN_CONTROLLED_YEFFAI_INSTALL_STEPS_OR_PROVIDE_CATEGORY_RUNTIME_EVIDENCE": { "status": "CONTRACTED_AS_GATE", "execution_class": "CONTROL_GATE", "remote_mutation_allowed": "NO_UNTIL_CHILD_STEP_CONTRACTED", "installation_command_allowed": "NO_UNTIL_CHILD_STEP_CONTRACTED", "expected_evidence": [ "specific_child_step_id", "child_step_contract", "expected_remote_delta", "rollback_rule", "runtime_binding_rule" ], "canon_outputs": [ "execution_contract_gap_queue.json", "execution_observable_contract_registry.json" ], "runtime_fields": [ "contract_gap_status", "contract_gap_open_count", "next_required_action" ] }, "FOLLOW_UI_NEXT_AUTHORIZED_JOB": { "status": "CONTRACTED_AS_GATE", "execution_class": "CONTROL_GATE", "remote_mutation_allowed": "NO", "installation_command_allowed": "NO", "purpose": "Non-executable UI planning gate used only to instruct the operator and runtime to resolve the next concrete authorized job from canonical state.", "expected_evidence": [ "plan.next_required_action", "jobs.next_required_action", "ledger.required_next_action", "runtime.next_required_action" ], "expected_remote_delta": [], "validation_rule": { "pass": "Only valid as a non-executable gate when it does not authorize a command and no installation/mutation flags are YES.", "fail": "FAIL if treated as an executable command.", "missing": "MISSING if the UI cannot resolve the next concrete job from canon/state." }, "failure_rule": "If this gate remains after a concrete action is available, repair canon precedence before execution.", "rollback_rule": "No remote rollback required because this action is a local planning gate only.", "canon_outputs": [ "execution_server_integration_plan.json", "yeffai_bootstrap_jobs.json", "execution_ledger.json" ], "runtime_fields": [ "next_required_action", "next_required_action_source" ], "ui_visibility_rule": "May appear in UI only as a non-executable planning label; it must not be rendered as an install command." }, "TARGET_SCAN": { "status": "CONTRACTED", "execution_class": "READ_ONLY", "remote_mutation_allowed": "NO", "installation_command_allowed": "NO", "purpose": "Read-only target scan action that observes YEFF AI server baseline, SSH/read status, OS, expected installation absence and operational scan fields before installation.", "expected_evidence": [ "target_ssh_auth_status", "target_live_read_status", "target_scan_status", "target_scan_hostname", "target_scan_whoami", "target_scan_os_pretty", "target_scan_opt_yeffai_exists", "target_scan_remote_mutation_policy" ], "expected_remote_delta": [], "validation_rule": { "pass": "PASS when SSH/read evidence is collected, target scan status is PASS and remote mutation policy remains read-only.", "fail": "FAIL if scan changes remote state or reports contradictory host identity.", "missing": "MISSING if scan evidence or target read status is absent." }, "failure_rule": "Block installation until target scan evidence is restored and host identity is confirmed.", "rollback_rule": "No remote rollback required; if local state is corrupted, restore Waresites canon/state backup.", "canon_outputs": [ "yeffai_target_operational_scan.json", "yeffai_target_live_runtime.json", "execution_ledger.json", "execution_ledger.jsonl" ], "runtime_fields": [ "target_scan_status", "target_scan_ssh_auth_status", "target_scan_remote_read_status", "target_scan_next_required_action" ], "ui_visibility_rule": "Visible as read-only target verification, never as installation progress." }, "CATEGORY_REMOTE_VERIFY": { "status": "CONTRACTED", "execution_class": "READ_ONLY", "remote_mutation_allowed": "NO", "installation_command_allowed": "NO", "purpose": "Read-only category remote verification action that compares DH/category execution expectations against remote YEFF AI evidence availability without mutating the target.", "expected_evidence": [ "yeffai_category_remote_verification_contract.json", "category_count", "remote_verification_state", "categories_missing", "target_scan_status", "target_ssh_auth_status", "target_remote_read_status" ], "expected_remote_delta": [], "validation_rule": { "pass": "PASS when the category verification contract exists and the job records read-only verification result without target mutation.", "fail": "FAIL if category verification claims remote completion without evidence or mutates YEFF AI.", "missing": "MISSING while category runtime evidence is not implemented or category remote state is absent." }, "failure_rule": "Keep category verification incomplete until remote evidence state is generated by a read-only worker.", "rollback_rule": "No remote rollback required; restore Waresites contract/job/ledger backup if local state is corrupted.", "canon_outputs": [ "yeffai_category_remote_verification_contract.json", "yeffai_bootstrap_jobs.json", "execution_ledger.json", "execution_ledger.jsonl" ], "runtime_fields": [ "jobs_status", "last_job_status", "target_scan_status", "next_required_action" ], "ui_visibility_rule": "Visible as remote verification readiness, not as proof that categories are installed." }, "YEFFAI_CONTROLLED_INSTALLATION_PRECHECK": { "status": "CONTRACTED", "execution_class": "READ_ONLY", "remote_mutation_allowed": "NO", "installation_command_allowed": "NO", "purpose": "Concrete child step under BEGIN_CONTROLLED gate that performs only read-only installation precheck before any mutating install step is contracted.", "child_step_contract_file": "/home/yeff/public_html/devon/canon/execution/state/yeffai_controlled_installation_precheck_step_contract.json", "expected_evidence": [ "REMOTE_HOSTNAME=YeffAI", "REMOTE_WHOAMI=root", "REMOTE_OS_PRETTY", "REBOOT_REQUIRED", "ROOT_DISK", "MEMORY_STATUS", "APT_LOCK_STATUS", "OPT_YEFFAI_EXISTS", "DOCKER_BIN", "NGINX_BIN", "UFW_STATUS", "PRECHECK_STATUS", "UFW_STATUS_NORMALIZED" ], "expected_remote_delta": [], "validation_rule": { "pass": "PASS when read-only precheck evidence confirms target identity, baseline health and no installation mutation.", "fail": "FAIL if the precheck mutates YEFF AI or contradicts expected target identity.", "missing": "MISSING if any required precheck evidence is absent." }, "failure_rule": "Do not create mutating installation step until precheck evidence is PASS.", "rollback_rule": "No remote rollback because this child step is read-only. Restore Waresites canon/state backup if local state update fails.", "canon_outputs": [ "yeffai_controlled_installation_precheck_step_contract.json", "yeffai_bootstrap_jobs.json", "execution_ledger.json", "execution_ledger.jsonl" ], "runtime_fields": [ "next_required_action", "contract_gap_status", "contract_gap_open_count" ], "ui_visibility_rule": "Render as the next concrete precheck step, not as an installation command.", "ufw_status_empty_output_policy": { "status": "PASS", "rule": "If UFW_BIN=YES and the raw ufw status command returns an empty first line, normalize UFW_STATUS to UNKNOWN_EMPTY_OUTPUT and keep raw value in UFW_STATUS_RAW.", "reason": "The precheck requires an observable firewall field, but empty ufw output is an observed read-only command result, not remote mutation and not installation failure.", "validation": "PASS when UFW_STATUS is non-empty after normalization and UFW_STATUS_RAW is preserved." } }, "YEFFAI_CONTROLLED_INSTALLATION_PRECHECK_REVIEW": { "status": "CONTRACTED_AS_GATE", "execution_class": "REVIEW_GATE", "remote_mutation_allowed": "NO", "reboot_executed": "NO", "installation_command_allowed": "NO", "installation_started": "NO", "purpose": "Review gate after successful YEFF AI controlled installation precheck. It evaluates REBOOT_REQUIRED and UFW inactive risks before any mutating installation child step can be contracted.", "expected_evidence": [ "yeffai_controlled_installation_precheck_latest.json", "audit_yeffai_controlled_installation_precheck_review_20260630_120414.json", "precheck.status=PASS", "reboot_required=YES", "ufw_status=Status: inactive" ], "expected_remote_delta": [], "validation_rule": { "pass": "PASS when precheck evidence exists, no remote mutation occurred, and review decision is represented as a non-executable gate.", "fail": "FAIL if this review gate is treated as reboot, install or any remote mutation command.", "missing": "MISSING while REBOOT_REQUIRED remains uncontracted for operator approval." }, "failure_rule": "Block mutating installation while review finds uncontracted blocking risk.", "rollback_rule": "No remote rollback because this is a local review gate only. Restore Waresites canon/state backup if local state is corrupted.", "canon_outputs": [ "execution_observable_contract_registry.json", "execution_contract_gap_queue.json", "execution_contract_gap_worker_latest.json", "execution_server_integration_plan.json", "yeffai_bootstrap_jobs.json", "yeffai_target_pull_worker_latest.json", "yeffai_target_operational_scan.json", "execution_ledger.json", "execution_ledger.jsonl" ], "runtime_fields": [ "next_required_action", "contract_gap_status", "contract_gap_open_count" ], "ui_visibility_rule": "Visible as a precheck review gate. It is not a reboot command, not an installation command and not a target mutation." }, "YEFFAI_REBOOT_REQUIRED_APPROVAL_GATE": { "status": "CONTRACTED_AS_GATE", "execution_class": "HUMAN_APPROVAL_GATE", "remote_mutation_allowed": "NO", "reboot_executed": "NO", "installation_command_allowed": "NO", "installation_started": "NO", "purpose": "Operator approval gate required because YEFF AI target reports reboot-required before mutating installation.", "expected_evidence": [ "yeffai_precheck_blocking_risk_contract.json", "yeffai_reboot_required_approval_gate_contract.json", "yeffai_controlled_installation_precheck_latest.json", "reboot_required=YES" ], "expected_remote_delta": [], "validation_rule": { "pass": "PASS when gate is contracted and next action is visible without remote mutation.", "fail": "FAIL if treated as a reboot command or installation command.", "missing": "MISSING until operator approval decision is recorded." }, "failure_rule": "Block mutating installation while reboot decision is absent.", "rollback_rule": "No remote rollback required; restore Waresites canon/state backup if local state is corrupted.", "canon_outputs": [ "yeffai_precheck_blocking_risk_contract.json", "yeffai_reboot_required_approval_gate_contract.json", "yeffai_firewall_inactive_security_review_contract.json", "execution_server_integration_plan.json", "yeffai_bootstrap_jobs.json", "execution_ledger.json", "execution_ledger.jsonl" ], "runtime_fields": [ "next_required_action", "contract_gap_status", "contract_gap_open_count" ], "ui_visibility_rule": "Visible as a human approval gate. It is not a reboot command and not an installation command." }, "YEFFAI_CONTROLLED_REBOOT_CONTRACT": { "status": "CONTRACTED", "execution_class": "REMOTE_MUTATION_CONTRACT_GATE", "remote_mutation_allowed": "NO_UNTIL_EXPLICIT_REBOOT_EXECUTION_PATCH", "reboot_executed": "NO", "installation_command_allowed": "NO", "installation_started": "NO", "purpose": "Local contract gate for the controlled reboot action. It defines the future reboot action but does not execute it.", "expected_evidence": [ "yeffai_controlled_reboot_action_contract.json", "yeffai_reboot_required_approval_gate_contract.json", "yeffai_precheck_blocking_risk_contract.json" ], "expected_remote_delta": [], "validation_rule": { "pass": "PASS when the controlled reboot action contract exists and no reboot has been executed.", "fail": "FAIL if this contract gate executes reboot.", "missing": "MISSING if the controlled reboot action contract is absent." }, "failure_rule": "Do not proceed to reboot execution without explicit execution approval patch.", "rollback_rule": "No remote rollback because this gate is local only.", "canon_outputs": [ "yeffai_controlled_reboot_action_contract.json", "execution_server_integration_plan.json", "yeffai_bootstrap_jobs.json", "execution_ledger.json", "execution_ledger.jsonl" ], "runtime_fields": [ "next_required_action", "contract_gap_status", "contract_gap_open_count" ], "ui_visibility_rule": "Render as contract-created state, not as executed reboot." }, "YEFFAI_CONTROLLED_REBOOT_READY_FOR_EXECUTION_APPROVAL": { "status": "CONTRACTED_AS_GATE", "execution_class": "HUMAN_APPROVAL_GATE", "remote_mutation_allowed": "NO_UNTIL_EXPLICIT_REBOOT_EXECUTION_PATCH", "reboot_executed": "NO", "installation_command_allowed": "NO", "installation_started": "NO", "purpose": "Final human approval gate before executing the controlled reboot patch on YEFF AI.", "expected_evidence": [ "yeffai_controlled_reboot_action_contract.json", "operator explicit approval", "post reboot verification expectation" ], "expected_remote_delta": [], "validation_rule": { "pass": "PASS when the gate is visible and reboot has not executed.", "fail": "FAIL if treated as the reboot execution itself.", "missing": "MISSING until explicit execution approval is recorded." }, "failure_rule": "Keep installation blocked until explicit reboot execution approval is given and executed through a dedicated patch.", "rollback_rule": "No remote rollback because this gate is local only.", "canon_outputs": [ "execution_observable_contract_registry.json", "yeffai_controlled_reboot_action_contract.json", "execution_server_integration_plan.json", "yeffai_bootstrap_jobs.json", "execution_ledger.json", "execution_ledger.jsonl" ], "runtime_fields": [ "next_required_action", "contract_gap_status", "contract_gap_open_count" ], "ui_visibility_rule": "Visible as explicit reboot execution approval gate. It is not a command." }, "YEFFAI_POST_REBOOT_READINESS_REVIEW": { "status": "CONTRACTED_AS_GATE", "execution_class": "READ_ONLY_REVIEW_GATE", "remote_mutation_allowed": "NO", "reboot_executed": "NO_BY_DEVON", "installation_command_allowed": "NO", "installation_started": "NO", "purpose": "Read-only post-reboot readiness review after identity reconciliation and cleared reboot-required blocker.", "expected_evidence": [ "yeffai_target_identity_reconciliation_latest.json", "yeffai_post_reboot_readiness_review_contract.json", "confirm_reboot_required=NO", "hostname=vmi2858754", "whoami=root" ], "expected_remote_delta": [], "validation_rule": { "pass": "PASS when post-reboot readiness audit confirms the target is reachable, identity is reconciled, reboot-required is clear, package manager is ready, and no installation has started.", "fail": "FAIL if this gate executes installation, reboot or any mutation.", "missing": "MISSING until the post-reboot readiness audit exists." }, "failure_rule": "Block installation until post-reboot readiness audit passes.", "rollback_rule": "No remote rollback because this gate is local/read-only.", "canon_outputs": [ "execution_observable_contract_registry.json", "yeffai_target_identity_reconciliation_latest.json", "yeffai_post_reboot_readiness_review_contract.json", "execution_server_integration_plan.json", "yeffai_bootstrap_jobs.json", "execution_ledger.json", "execution_ledger.jsonl" ], "runtime_fields": [ "next_required_action", "contract_gap_status", "contract_gap_open_count" ], "ui_visibility_rule": "Render as post-reboot readiness review; it is not a reboot command and not an install command." }, "RECONCILE_IDENTITY_SKIP_UNNEEDED_REBOOT": { "status": "CONTRACTED_RETROACTIVE_LOCAL_ACTION", "execution_class": "LOCAL_CANON_RECONCILIATION", "remote_mutation_allowed": "NO", "reboot_executed": "NO_BY_DEVON", "installation_command_allowed": "NO", "installation_started": "NO", "purpose": "Records the local canon reconciliation that accepted the observed YEFFAI provider hostname and skipped reboot because live evidence showed reboot_required=NO.", "expected_evidence": [ "yeffai_target_identity_reconciliation_latest.json", "yeffai_post_reboot_readiness_review_contract.json", "jobs.jobs[].action=RECONCILE_IDENTITY_SKIP_UNNEEDED_REBOOT", "confirm_reboot_required=NO", "hostname=vmi2858754", "whoami=root" ], "expected_remote_delta": [], "validation_rule": { "pass": "PASS when the action is present only as a local canon reconciliation, remote_yeffai_mutation=NO, installation_command_executed=NO and installation_started=NO.", "fail": "FAIL if this action is treated as SSH mutation, reboot, installation or remote execution.", "missing": "MISSING if identity reconciliation evidence is absent." }, "failure_rule": "Block readiness audit if this reconciliation action is unregistered.", "rollback_rule": "Restore Waresites canon/state backup; no remote rollback exists because no remote mutation occurred.", "canon_outputs": [ "yeffai_target_identity_reconciliation_latest.json", "yeffai_post_reboot_readiness_review_contract.json", "execution_server_integration_plan.json", "yeffai_bootstrap_jobs.json", "execution_ledger.json", "execution_ledger.jsonl" ], "runtime_fields": [ "next_required_action", "contract_gap_status", "contract_gap_open_count" ], "ui_visibility_rule": "Render as local reconciliation event only. It is not a reboot command, not installation and not target mutation." }, "YEFFAI_PRE_INSTALLATION_BASELINE_DECISION_GATE": { "status": "CONTRACTED_AS_GATE", "execution_class": "LOCAL_DECISION_GATE", "remote_mutation_allowed": "NO", "reboot_executed": "NO", "installation_command_allowed": "NO", "installation_started": "NO", "purpose": "Decision gate after post-reboot/readiness audit passes. It authorizes creation of a separate installation step contract, not installation execution.", "expected_evidence": [ "yeffai_post_reboot_readiness_audit_latest.json", "readiness status PASS", "reboot_required=NO", "apt_lock_status=FREE", "identity reconciled" ], "expected_remote_delta": [], "validation_rule": { "pass": "PASS when readiness audit is PASS and no installation has started.", "fail": "FAIL if this gate runs install or remote mutation.", "missing": "MISSING until an explicit installation step contract is created." }, "failure_rule": "Do not install without a dedicated child step contract.", "rollback_rule": "No remote rollback because this is a local decision gate.", "canon_outputs": [ "yeffai_post_reboot_readiness_audit_latest.json", "execution_server_integration_plan.json", "yeffai_bootstrap_jobs.json", "execution_ledger.json", "execution_ledger.jsonl" ], "runtime_fields": [ "next_required_action", "contract_gap_status", "contract_gap_open_count" ], "ui_visibility_rule": "Visible as readiness decision gate, not as install execution." }, "YEFFAI_POST_REBOOT_READINESS_REVIEW_BLOCKED": { "status": "CONTRACTED_AS_GATE", "execution_class": "BLOCKING_REVIEW_GATE", "remote_mutation_allowed": "NO", "reboot_executed": "NO", "installation_command_allowed": "NO", "installation_started": "NO", "purpose": "Blocking gate if post-reboot readiness audit finds unresolved baseline issues.", "expected_evidence": [ "yeffai_post_reboot_readiness_audit_latest.json", "blocking_findings" ], "expected_remote_delta": [], "validation_rule": { "pass": "PASS when blocking findings are reviewed and resolved.", "fail": "FAIL if installation proceeds with blocking findings.", "missing": "MISSING while findings remain open." }, "failure_rule": "Keep installation blocked.", "rollback_rule": "No remote rollback because this is local/read-only.", "canon_outputs": [ "yeffai_post_reboot_readiness_audit_latest.json" ], "runtime_fields": [ "next_required_action", "contract_gap_status", "contract_gap_open_count" ], "ui_visibility_rule": "Visible as blocked readiness review." }, "YEFFAI_POST_REBOOT_READINESS_AUDIT": { "status": "CONTRACTED_RETROACTIVE_READ_ONLY_ACTION", "execution_class": "READ_ONLY_AUDIT", "remote_mutation_allowed": "NO", "reboot_executed": "NO_BY_DEVON", "installation_command_allowed": "NO", "installation_started": "NO", "purpose": "Records the read-only post-reboot/rebuild readiness audit against the YEFFAI target after identity reconciliation.", "expected_evidence": [ "yeffai_post_reboot_readiness_audit_latest.json", "remote_raw_evidence", "reboot_required=NO", "apt_lock_status=FREE", "installation_started=NO", "installation_command_executed=NO" ], "expected_remote_delta": [], "validation_rule": { "pass": "PASS when the audit records remote baseline without mutating the target.", "fail": "FAIL if audit executes package install, reboot or any remote mutation.", "missing": "MISSING if readiness evidence is absent." }, "failure_rule": "Block baseline decision gate if the readiness audit action is unregistered.", "rollback_rule": "Restore Waresites canon/state backup. No remote rollback exists because this action is read-only.", "canon_outputs": [ "yeffai_post_reboot_readiness_audit_latest.json", "execution_server_integration_plan.json", "yeffai_bootstrap_jobs.json", "execution_ledger.json", "execution_ledger.jsonl" ], "runtime_fields": [ "next_required_action", "contract_gap_status", "contract_gap_open_count" ], "ui_visibility_rule": "Render as completed read-only readiness audit, not as installation." }, "YEFFAI_FIRST_INSTALLATION_STEP_CONTRACT_GATE": { "status": "CONTRACTED_AS_GATE", "execution_class": "INSTALLATION_STEP_CONTRACT_GATE", "remote_mutation_allowed": "NO_UNTIL_CHILD_STEP_PATCH", "reboot_executed": "NO", "installation_command_allowed": "NO", "installation_started": "NO", "purpose": "Gate for creating the first dedicated YEFF AI installation step contract. This gate does not execute installation.", "expected_evidence": [ "yeffai_pre_installation_baseline_decision_gate_contract.json", "yeffai_post_reboot_readiness_audit_latest.json", "contract_gap_status=PASS", "installation_started=NO", "installation_command_executed=NO" ], "expected_remote_delta": [], "validation_rule": { "pass": "PASS when the first child installation step contract is created without executing it.", "fail": "FAIL if this action executes remote mutation directly.", "missing": "MISSING until the child installation step contract is created." }, "failure_rule": "Do not run installation until the child step contract defines command, evidence, validation and recovery.", "rollback_rule": "Restore Waresites canon/state backup. No remote rollback because this gate is local only.", "canon_outputs": [ "execution_observable_contract_registry.json", "yeffai_pre_installation_baseline_decision_gate_contract.json", "yeffai_pre_installation_ufw_inactive_security_review_contract.json", "execution_server_integration_plan.json", "yeffai_bootstrap_jobs.json", "execution_ledger.json", "execution_ledger.jsonl" ], "runtime_fields": [ "next_required_action", "contract_gap_status", "contract_gap_open_count" ], "ui_visibility_rule": "Render as first installation step contract gate, not as install execution." }, "REPAIR_READINESS_AUDIT_ACTION_AND_CONTRACT_BASELINE": { "status": "CONTRACTED_RETROACTIVE_LOCAL_REPAIR_ACTION", "execution_class": "LOCAL_CANON_REPAIR_AND_CONTRACT", "remote_mutation_allowed": "NO", "reboot_executed": "NO_BY_DEVON", "installation_command_allowed": "NO", "installation_started": "NO", "purpose": "Records the local canon repair that registered the read-only readiness audit action, resolved the local gap, created baseline decision and UFW review contracts, and moved the system to the first installation step contract gate.", "expected_evidence": [ "yeffai_post_reboot_readiness_audit_latest.json", "yeffai_pre_installation_baseline_decision_gate_contract.json", "yeffai_pre_installation_ufw_inactive_security_review_contract.json", "jobs.jobs[].action=REPAIR_READINESS_AUDIT_ACTION_AND_CONTRACT_BASELINE", "next_required_action=YEFFAI_FIRST_INSTALLATION_STEP_CONTRACT_GATE", "installation_started=NO", "installation_command_executed=NO" ], "expected_remote_delta": [], "validation_rule": { "pass": "PASS when the action is registered as local-only, the exact contract gap is resolved, runtime exposes the first installation step contract gate, and no remote mutation or installation occurred.", "fail": "FAIL if this action is interpreted as target mutation, package installation, reboot or public exposure.", "missing": "MISSING if any canon source still exposes the generic next action or any contract gap remains open." }, "failure_rule": "Block first installation step contract generation until registry, gap queue, plan, jobs, pull, scan, ledger and runtime agree on the same next action.", "rollback_rule": "Restore Waresites canon/state backup. No remote rollback exists because this repair is local-only.", "canon_outputs": [ "execution_observable_contract_registry.json", "execution_contract_gap_queue.json", "execution_contract_gap_worker_latest.json", "execution_server_integration_plan.json", "yeffai_bootstrap_jobs.json", "yeffai_target_pull_worker_latest.json", "yeffai_target_operational_scan.json", "execution_ledger.json", "execution_ledger.jsonl" ], "runtime_fields": [ "next_required_action", "contract_gap_status", "contract_gap_open_count", "target_pull_worker_installation_started", "target_pull_worker_installation_command_executed" ], "ui_visibility_rule": "Render as completed local repair and baseline contract transition, not as install execution." }, "REGISTER_REPAIR_ACTION_AND_FIX_RUNTIME_SOURCES": { "status": "CONTRACTED_RETROACTIVE_LOCAL_REPAIR_ACTION", "execution_class": "LOCAL_CANON_REPAIR", "remote_mutation_allowed": "NO", "reboot_executed": "NO_BY_DEVON", "installation_command_allowed": "NO", "installation_started": "NO", "purpose": "Records the local repair that registered a prior local repair action, resolved its contract gap, and aligned the runtime source canon to the first installation step contract gate.", "expected_evidence": [ "jobs.jobs[].action=REGISTER_REPAIR_ACTION_AND_FIX_RUNTIME_SOURCES", "gap_id=gap_2a9235d376e002a629204ba0", "next_required_action=YEFFAI_FIRST_INSTALLATION_STEP_CONTRACT_GATE", "contract_gap_status=PASS", "contract_gap_open_count=0", "installation_started=NO", "installation_command_executed=NO" ], "expected_remote_delta": [], "validation_rule": { "pass": "PASS when the action is registered as local-only, its exact gap is resolved, and runtime/canon agree on the first installation step contract gate.", "fail": "FAIL if this action is treated as remote mutation, reboot, installation or public exposure.", "missing": "MISSING if any contract gap remains open or pull/scan are not aligned." }, "failure_rule": "Block first installation step contract until this local repair action is registered and its gap is resolved.", "rollback_rule": "Restore Waresites canon/state backup. No remote rollback exists because no remote mutation occurs.", "canon_outputs": [ "execution_observable_contract_registry.json", "execution_contract_gap_queue.json", "execution_contract_gap_worker_latest.json", "execution_server_integration_plan.json", "yeffai_bootstrap_jobs.json", "yeffai_target_pull_worker_latest.json", "yeffai_target_operational_scan.json", "execution_ledger.json", "execution_ledger.jsonl" ], "runtime_fields": [ "next_required_action", "contract_gap_status", "contract_gap_open_count", "target_pull_worker_installation_started", "target_pull_worker_installation_command_executed" ], "ui_visibility_rule": "Render as completed local repair only, not as installation execution." }, "REGISTER_EXACT_OPEN_ACTION_REPAIR_PULL_SCAN_AND_RERUN_STABLE_GATE_AUDIT": { "status": "CONTRACTED_LOCAL_REPAIR_ACTION", "execution_class": "LOCAL_CANON_REPAIR", "remote_mutation_allowed": "NO", "reboot_executed": "NO_BY_DEVON", "installation_command_allowed": "NO", "installation_started": "NO", "purpose": "Registers this exact repair action so its jobs ledger entry cannot generate a new UNKNOWN_ACTION gap.", "expected_evidence": [ "audit_open_gap_before_first_installation_contract_repair_latest evidence", "gap_id=gap_2a9235d376e002a629204ba0 resolved", "pull.next_required_action=YEFFAI_FIRST_INSTALLATION_STEP_CONTRACT_GATE", "scan.next_required_action=YEFFAI_FIRST_INSTALLATION_STEP_CONTRACT_GATE", "runtime.contract_gap_status=PASS", "runtime.contract_gap_open_count=0" ], "expected_remote_delta": [], "validation_rule": { "pass": "PASS when the patch completes as local canon repair and does not execute remote commands.", "fail": "FAIL if any installation command, reboot or remote mutation occurs.", "missing": "MISSING if runtime/canon do not converge after repair." }, "failure_rule": "Do not create first installation step contract until this repair validates PASS.", "rollback_rule": "Restore Waresites canon/state backup. No remote rollback exists because no remote mutation occurs.", "canon_outputs": [ "execution_observable_contract_registry.json", "execution_contract_gap_queue.json", "execution_contract_gap_worker_latest.json", "execution_server_integration_plan.json", "yeffai_bootstrap_jobs.json", "yeffai_target_pull_worker_latest.json", "yeffai_target_operational_scan.json", "execution_ledger.json", "execution_ledger.jsonl" ], "runtime_fields": [ "next_required_action", "contract_gap_status", "contract_gap_open_count" ], "ui_visibility_rule": "Render as local repair completed; next visible action remains the first installation step contract gate." }, "REPAIR_PULL_SCAN_BEFORE_INSTALL_CONTRACT_AFTER_GAP_PASS": { "status": "CONTRACTED_LOCAL_PULL_SCAN_REPAIR", "execution_class": "LOCAL_CANON_REPAIR", "remote_mutation_allowed": "NO", "reboot_executed": "NO_BY_DEVON", "installation_command_allowed": "NO", "installation_started": "NO", "purpose": "Repairs pull.latest and scan next_required_action after contract gaps were already PASS/open zero, preserving the first installation step contract gate.", "expected_evidence": [ "contract_gap_status=PASS", "contract_gap_open_count=0", "pull.next_required_action=YEFFAI_FIRST_INSTALLATION_STEP_CONTRACT_GATE", "scan.next_required_action=YEFFAI_FIRST_INSTALLATION_STEP_CONTRACT_GATE", "runtime.next_required_action=YEFFAI_FIRST_INSTALLATION_STEP_CONTRACT_GATE", "installation_started=NO", "installation_command_executed=NO" ], "expected_remote_delta": [], "validation_rule": { "pass": "PASS when pull, scan, plan, jobs, ledger and runtime agree on the first installation step contract gate with no open gaps.", "fail": "FAIL if this action performs SSH, remote mutation, reboot or installation.", "missing": "MISSING if pull or scan regress again." }, "failure_rule": "Do not create the installation contract until pull and scan converge.", "rollback_rule": "Restore Waresites canon/state backup. No remote rollback exists because no remote mutation occurs.", "canon_outputs": [ "execution_observable_contract_registry.json", "execution_server_integration_plan.json", "yeffai_bootstrap_jobs.json", "yeffai_target_pull_worker_latest.json", "yeffai_target_operational_scan.json", "execution_ledger.json", "execution_ledger.jsonl" ], "runtime_fields": [ "next_required_action", "contract_gap_status", "contract_gap_open_count", "target_pull_worker_installation_started", "target_pull_worker_installation_command_executed" ], "ui_visibility_rule": "Render as local canon repair only; next action remains first installation step contract gate." }, "REPAIR_PULL_SCAN_WORKER_PERSISTENCE_BEFORE_INSTALL_CONTRACT_V3_NO_EXIT": { "status": "CONTRACTED_LOCAL_WORKER_PERSISTENCE_REPAIR", "execution_class": "LOCAL_CANON_REPAIR", "remote_mutation_allowed": "NO", "reboot_executed": "NO_BY_DEVON", "installation_command_allowed": "NO", "installation_started": "NO", "purpose": "Repairs recurring pull/scan regression by adding a guarded local worker finalizer that preserves YEFFAI_FIRST_INSTALLATION_STEP_CONTRACT_GATE when canon is in the first installation contract gate and no installation has started.", "expected_evidence": [ "pull.next_required_action=YEFFAI_FIRST_INSTALLATION_STEP_CONTRACT_GATE", "scan.next_required_action=YEFFAI_FIRST_INSTALLATION_STEP_CONTRACT_GATE", "runtime.next_required_action=YEFFAI_FIRST_INSTALLATION_STEP_CONTRACT_GATE", "contract_gap_status=PASS", "contract_gap_open_count=0", "installation_started=NO", "installation_command_executed=NO", "remote_yeffai_mutation=NO", "worker bash lint PASS" ], "expected_remote_delta": [], "validation_rule": { "pass": "PASS when worker lint passes, pull/scan persist on the first installation step contract gate, runtime agrees, no open gaps exist and no remote mutation occurred.", "fail": "FAIL if the worker patch breaks bash syntax, performs SSH, starts installation or mutates YEFF AI.", "missing": "MISSING if pull or scan regress again." }, "failure_rule": "Do not create the first dedicated installation contract until worker persistence is stable.", "rollback_rule": "Restore Waresites canon/state and worker backup. No remote rollback exists because no remote mutation occurs.", "canon_outputs": [ "execution_observable_contract_registry.json", "execution_server_integration_plan.json", "yeffai_bootstrap_jobs.json", "yeffai_target_pull_worker_latest.json", "yeffai_target_operational_scan.json", "execution_ledger.json", "execution_ledger.jsonl", "yeffai_target_pull_worker.sh" ], "runtime_fields": [ "next_required_action", "contract_gap_status", "contract_gap_open_count", "target_pull_worker_installation_started", "target_pull_worker_installation_command_executed" ], "ui_visibility_rule": "Render as local worker persistence repair only; next action remains the first installation step contract gate." }, "GENERATE_FIRST_DEDICATED_INSTALLATION_STEP_CONTRACT_SAFE_NO_EXIT": { "status": "CONTRACTED_LOCAL_CONTRACT_GENERATION", "execution_class": "LOCAL_CONTRACT_GENERATION", "remote_mutation_allowed": "NO", "installation_command_allowed": "NO", "installation_started": "NO", "purpose": "Create the STEP 001 approval contract without remote mutation." }, "YEFFAI_INSTALL_STEP_001_SERVER_BASELINE_CONFIG_APPROVAL_GATE": { "status": "CONTRACTED_APPROVAL_GATE", "execution_class": "INSTALLATION_STEP_APPROVAL_GATE", "remote_mutation_allowed": "NO_UNTIL_EXPLICIT_USER_APPROVAL", "next_executable_action_after_approval": "YEFFAI_INSTALL_STEP_001_SERVER_BASELINE_CONFIG_EXECUTE", "installation_command_allowed": "NO", "installation_started": "NO" }, "YEFFAI_INSTALL_STEP_001_SERVER_BASELINE_CONFIG_EXECUTE": { "status": "CONTRACTED_REMOTE_STEP_PENDING_APPROVAL", "execution_class": "REMOTE_CONFIGURATION_STEP", "remote_mutation_allowed": "NO", "target_ssh_alias": "YEFFAI", "target_ip": "157.173.100.205", "reboot_allowed": "NO", "package_install_allowed": "NO", "installation_command_allowed": "NO", "installation_started": "NO", "expected_remote_delta": [ "/opt/yeffai", "/opt/yeffai/runtime", "/opt/yeffai/state", "/opt/yeffai/logs", "/opt/yeffai/backup", "/opt/yeffai/contracts", "/opt/yeffai/evidence" ], "blocked_remote_commands": [ "apt install", "apt upgrade", "docker install", "nginx install", "ufw allow public traffic", "reboot", "start YEFF AI application" ] }, "YEFFAI_INSTALL_STEP_001_SERVER_BASELINE_CONFIG_VERIFY": { "status": "CONTRACTED_REMOTE_VERIFY_PENDING_EXECUTION", "execution_class": "REMOTE_EVIDENCE_VERIFICATION", "remote_mutation_allowed": "NO_READ_ONLY", "target_ssh_alias": "YEFFAI", "target_ip": "157.173.100.205" }, "REPAIR_STEP001_APPROVAL_GATE_CANON_ALIGNMENT_SAFE": { "status": "CONTRACTED_LOCAL_CANON_REPAIR", "execution_class": "LOCAL_CANON_REPAIR", "remote_mutation_allowed": "NO", "installation_command_allowed": "NO", "installation_started": "NO", "purpose": "Realigns plan, pull, scan and ledger to the already contracted STEP 001 approval gate without remote mutation.", "expected_remote_delta": [], "validation_rule": { "pass": "PASS when plan, jobs, pull, scan, ledger, contract and runtime expose the STEP 001 approval gate.", "fail": "FAIL if any remote mutation, reboot or installation command occurs.", "missing": "MISSING if any canonical source remains on a generic next action." }, "rollback_rule": "Restore Waresites canon/state backup. No remote rollback exists because no remote mutation occurs." }, "REORDER_YEFFAI_INSTALL_FLOW_CREATE_STEP000_SERVER_OS_UPDATE_GATE": { "status": "CONTRACTED_LOCAL_REORDER", "execution_class": "LOCAL_CONTRACT_REORDER", "remote_mutation_allowed": "NO", "installation_command_allowed": "NO", "installation_started": "NO", "purpose": "Reorders YEFF AI installation flow so controlled server OS update approval happens before STEP 001 directory baseline configuration.", "expected_remote_delta": [], "validation_rule": { "pass": "PASS when canon points to STEP 000 approval gate and no remote mutation occurred.", "fail": "FAIL if SSH, apt, reboot or any remote mutation occurs.", "missing": "MISSING if runtime does not expose STEP 000 approval gate." }, "rollback_rule": "Restore Waresites canon/state backup." }, "YEFFAI_INSTALL_STEP_000_SERVER_OS_UPDATE_APPROVAL_GATE": { "status": "CONTRACTED_APPROVAL_GATE", "execution_class": "INSTALLATION_STEP_APPROVAL_GATE", "remote_mutation_allowed": "NO_UNTIL_EXPLICIT_USER_APPROVAL", "next_executable_action_after_approval": "YEFFAI_INSTALL_STEP_000_SERVER_OS_UPDATE_EXECUTE", "installation_command_allowed": "NO", "installation_started": "NO", "purpose": "Waits for explicit approval before updating the YEFF AI server operating system packages." }, "YEFFAI_INSTALL_STEP_000_SERVER_OS_UPDATE_EXECUTE": { "status": "CONTRACTED_REMOTE_STEP_PENDING_APPROVAL", "execution_class": "REMOTE_SERVER_UPDATE_STEP", "remote_mutation_allowed": "NO", "target_ssh_alias": "YEFFAI", "target_ip": "157.173.100.205", "package_update_allowed": "YES_AFTER_APPROVAL", "package_upgrade_allowed": "YES_AFTER_APPROVAL", "reboot_allowed": "NO_SEPARATE_APPROVAL_REQUIRED_IF_REBOOT_REQUIRED", "docker_install_allowed": "NO", "nginx_install_allowed": "NO", "yeffai_install_allowed": "NO", "public_exposure_allowed": "NO", "allowed_remote_commands_after_approval": [ "apt-get update", "DEBIAN_FRONTEND=noninteractive apt-get -y upgrade", "apt-get -y autoremove", "test -f /var/run/reboot-required || true" ], "blocked_remote_commands": [ "apt-get install docker", "apt-get install nginx", "curl docker installer", "systemctl enable public services", "ufw allow public traffic", "reboot", "start YEFF AI application" ], "expected_remote_delta": [ "apt package indexes refreshed", "installed OS packages upgraded when available", "autoremove completed when safe", "reboot-required state captured" ] }, "YEFFAI_INSTALL_STEP_000_SERVER_OS_UPDATE_VERIFY": { "status": "CONTRACTED_REMOTE_VERIFY_PENDING_EXECUTION", "execution_class": "REMOTE_SERVER_UPDATE_VERIFY", "remote_mutation_allowed": "NO_READ_ONLY", "target_ssh_alias": "YEFFAI", "target_ip": "157.173.100.205", "next_step_if_no_reboot_required": "YEFFAI_INSTALL_STEP_001_SERVER_BASELINE_CONFIG_APPROVAL_GATE", "next_step_if_reboot_required": "YEFFAI_INSTALL_STEP_000_SERVER_OS_UPDATE_REBOOT_APPROVAL_GATE", "purpose": "Verifies OS update result and determines whether reboot approval is required before STEP 001." }, "REPAIR_AND_EXECUTE_YEFFAI_STEP000_OS_UPDATE_FROM_WARESITES": { "status": "CONTRACTED_REMOTE_STEP_REPAIR_AND_EXECUTE", "execution_class": "LOCAL_CANON_REPAIR_THEN_REMOTE_SERVER_UPDATE_STEP", "remote_mutation_allowed": "NO", "target_ssh_alias": "YEFFAI", "package_update_allowed": "YES", "package_upgrade_allowed": "YES", "docker_install_allowed": "NO", "nginx_install_allowed": "NO", "yeffai_install_allowed": "NO", "reboot_allowed": "NO", "purpose": "Repair local next_action drift before executing the approved STEP 000 OS update." }, "REPAIR_AND_EXECUTE_STEP000_OS_UPDATE_WITH_LOCK_AWARE_PREFLIGHT": { "status": "CONTRACTED_REMOTE_STEP_LOCK_AWARE_EXECUTE", "execution_class": "LOCAL_CANON_REPAIR_THEN_REMOTE_SERVER_UPDATE_STEP", "remote_mutation_allowed": "NO", "target_ssh_alias": "YEFFAI", "package_update_allowed": "YES", "package_upgrade_allowed": "YES", "docker_install_allowed": "NO", "nginx_install_allowed": "NO", "yeffai_install_allowed": "NO", "reboot_allowed": "NO", "purpose": "Repair local next_action drift and execute STEP 000 OS update only if apt locks are not held. unattended-upgrade-shutdown --wait-for-signal is not considered an active lock holder by itself." }, "RECONCILE_STEP000_PARTIAL_VERIFY_STATE_NO_REMOTE_MUTATION": { "status": "CONTRACTED_LOCAL_RECONCILIATION", "execution_class": "LOCAL_CANON_RECONCILIATION", "remote_mutation_allowed": "NO", "purpose": "Reconcile partial STEP 000 verify state after jobs advanced to verify and STEP000 latest evidence exists.", "next_required_action": "VERIFY_YEFFAI_INSTALL_STEP_001_SERVER_BASELINE_CONFIG", "remote_evidence_source": "/home/yeff/public_html/devon/canon/execution/state/yeffai_install_step_000_server_os_update_latest.json", "blocked_remote_commands": [ "apt-get update", "apt-get upgrade", "apt-get autoremove", "docker install", "nginx install", "YEFF AI install", "reboot" ] }, "STABILIZE_FLOW_HOLD_PULL_WORKER_VERIFY_STEP000_ROUTE_NEXT": { "status": "CONTRACTED_FLOW_STABILIZER", "execution_class": "LOCAL_CRON_HOLD_CANON_ALIGNMENT_THEN_REMOTE_READONLY_VERIFY", "remote_mutation_allowed": "NO", "purpose": "Stop recurring generic drift from pull worker cron, align all state sources from canonical JOBS plus STEP000 latest, then verify STEP000 read-only.", "canonical_source": [ "yeffai_bootstrap_jobs.json", "yeffai_install_step_000_server_os_update_latest.json" ], "blocked_remote_commands": [ "apt-get update", "apt-get upgrade", "apt-get autoremove", "docker install", "nginx install", "YEFF AI install", "reboot" ] }, "APPROVE_YEFFAI_TARGET_SIDE_MONITORING_SECURITY_CONTRACT": { "status": "CONTRACTED_APPROVAL_GATE", "execution_class": "CONTROL_GATE", "remote_mutation_allowed": "NO", "installation_command_allowed": "NO", "purpose": "Approval gate for the YEFF AI target-side monitoring and security contract before Step 002.", "expected_evidence": [ "yeffai_target_side_monitoring_security_contract.json", "execution_server_integration_plan.json", "execution_observable_contract_registry.json", "execution_ledger.json", "runtime_status.php" ], "expected_remote_delta": [], "validation_rule": { "pass": "PASS when the contract is visible and Step 002 remains blocked pending explicit approval.", "fail": "FAIL if treated as a remote command or installation step.", "missing": "MISSING if the contract file or plan pointer is absent." }, "rollback_rule": "Restore Waresites canon/state backups. No remote rollback required because this gate performs no YEFF AI mutation.", "canon_outputs": [ "yeffai_target_side_monitoring_security_contract.json", "execution_server_integration_plan.json", "execution_observable_contract_registry.json", "execution_ledger.json" ], "runtime_fields": [ "next_required_action", "target_side_monitoring_security_contract_status", "source_of_truth", "waresites_runtime_role" ], "ui_visibility_rule": "Render as an approval gate, not as installation progress." }, "REGISTER_EXECUTION_TIMELINE_CONTRACT_GAP": { "status": "CONTRACTED_LOCAL_CANON_INTAKE", "execution_class": "LOCAL_STATE_MUTATION", "remote_mutation_allowed": "NO", "installation_command_allowed": "NO", "purpose": "Register operator-discovered execution steps as OPEN contract gaps before any candidate command is executed on YEFF AI.", "expected_evidence": [ "execution_contract_gap_queue.json contains the new OPEN gap", "execution_ledger.jsonl contains execution_timeline_contract_gap_registered", "candidate_command_executed=NO", "remote_yeffai_mutation=NO" ], "validation_rule": { "pass": "PASS when the discovered step is persisted as OPEN without shell execution.", "fail": "FAIL when queue or ledger persistence fails.", "missing": "MISSING when runtime cannot expose the gap." }, "failure_rule": "Do not execute the discovered step until its contract, evidence, validation and rollback rules are formalized.", "rollback_rule": "Restore the contract-gap queue backup when queue validation or ledger persistence fails.", "runtime_fields": [ "contract_gap_status", "contract_gap_open_count", "contract_gap_record_count", "contract_gap_queue" ], "ui_visibility_rule": "Execution Timeline exposes Registrar etapa descoberta before Execution Categories.", "security_rule": "Same-origin JSON POST only; no shell or SSH execution is available in the endpoint.", "reusability_rule": "The intake is reusable across Devon projects and preserves the target server separately." } }, "known_observable_classes": { "remote_host_identity": { "status": "CONTRACTED", "fields": [ "REMOTE_HOSTNAME", "REMOTE_WHOAMI", "REMOTE_OS_PRETTY", "REMOTE_KERNEL" ] }, "remote_installation_absence": { "status": "CONTRACTED", "fields": [ "OPT_YEFFAI_EXISTS", "DOCKER_BIN", "NGINX_BIN" ] }, "remote_mutation_policy": { "status": "CONTRACTED", "fields": [ "REMOTE_MUTATION_EXECUTED", "INSTALLATION_COMMAND_EXECUTED", "INSTALLATION_STARTED" ] }, "future_installation_delta": { "status": "REQUIRES_CONTRACT_GAP_ON_FIRST_DISCOVERY", "fields": [] } }, "registry_update_rule": "Only add an action or observable after it has a gap entry, expected evidence, validation rule, failure mode and UI/runtime binding rule.", "remote_yeffai_mutation": "NO", "installation_command_executed": "NO", "installation_started": "NO", "updated_at": "2026-07-08T14:57:35.790591Z", "target_identity": { "YEFFAI": { "target_ssh_alias": "YEFFAI", "target_host_or_ip": "157.173.100.205", "accepted_hostname": "vmi2858754", "accepted_fqdn": "vmi2858754.contaboserver.net", "accepted_whoami": "root", "updated_at": "2026-06-30T15:47:04Z", "source": "/home/yeff/public_html/devon/canon/execution/state/yeffai_target_identity_reconciliation_latest.json" } }, "observable_contracts": [ { "action": "ENABLE_YEFFAI_GENERIC_REMOTE_EXECUTOR_AFTER_OPERATOR_APPROVAL", "action_id": "ENABLE_YEFFAI_GENERIC_REMOTE_EXECUTOR_AFTER_OPERATOR_APPROVAL", "contract_id": "observable_action_enable_yeffai_generic_remote_executor_after_operator_approval", "status": "CONTRACTED_BLOCKED", "created_at": "2026-07-01T20:37:32Z", "updated_at": "2026-07-01T20:37:32Z", "authority": "Register the human approval gate that may later enable the generic Waresites-to-YEFFAI executor. This action is observable and contracted, but it does not execute remote commands by itself.", "source_contract": "/home/yeff/public_html/devon/canon/execution/state/yeffai_generic_remote_executor_contract.json", "execution_class": "LOCAL_APPROVAL_GATE", "remote_mutation_allowed": "NO", "installation_command_allowed": "NO", "remote_yeffai_mutation": "NO", "installation_command_executed": "NO", "installation_started": "NO", "generic_remote_executor_enabled": "NO", "real_shell_execution_enabled": "NO", "ui_patch_allowed": "NO", "approval_gate_can_set_completion": "NO", "expected_evidence": [ "yeffai_generic_remote_executor_contract.json exists", "contract.status=CONTRACTED_BLOCKED", "contract.execution_state.generic_remote_executor_enabled=NO", "execution_server_integration_plan.next_required_action=ENABLE_YEFFAI_GENERIC_REMOTE_EXECUTOR_AFTER_OPERATOR_APPROVAL", "runtime_status.php exposes next_required_action=ENABLE_YEFFAI_GENERIC_REMOTE_EXECUTOR_AFTER_OPERATOR_APPROVAL", "completion_display_allowed=NO", "completion=null", "progress=null", "remote_yeffai_mutation=NO", "installation_command_executed=NO", "installation_started=NO" ], "validation_rule": { "pass": "PASS when the action is registered, current route points to it, executor remains disabled, runtime stays pending, and no YEFFAI mutation occurred.", "fail": "FAIL when registration corrupts registry, changes runtime progress, enables shell execution, or marks remote mutation/install started.", "missing": "MISSING when the generic executor contract, registry binding, route, runtime field or ledger evidence is absent." }, "failure_rule": "Any attempt to execute SSH mutation, enable shell execution, alter UI progress, or mark completion from this approval gate is FAIL.", "rollback_rule": "Restore Waresites canon/state backups for registry, gap queue, latest gap, ledger, plan, jobs and generic executor contract. No remote rollback exists because this action performs no remote mutation.", "canon_outputs": [ "/home/yeff/public_html/devon/canon/execution/state/execution_observable_contract_registry.json", "/home/yeff/public_html/devon/canon/execution/state/execution_contract_gap_queue.json", "/home/yeff/public_html/devon/canon/execution/state/execution_contract_gap_worker_latest.json", "/home/yeff/public_html/devon/canon/execution/state/execution_ledger.json", "/home/yeff/public_html/devon/canon/execution/state/execution_ledger.jsonl", "/home/yeff/public_html/devon/canon/execution/state/execution_server_integration_plan.json", "/home/yeff/public_html/devon/canon/execution/state/yeffai_bootstrap_jobs.json", "/home/yeff/public_html/devon/canon/execution/state/yeffai_generic_remote_executor_contract.json" ], "runtime_fields": [ "next_required_action", "completion_display_allowed", "completion", "completion_percent", "progress", "completion_source", "target_pull_worker_remote_yeffai_mutation", "target_pull_worker_installation_command_executed", "target_pull_worker_installation_started" ], "ui_binding_rule": "UI reads runtime_status.php only. Donut and progress remain PENDING until a later approved executor run emits real remote evidence.", "next_required_action_after_pass": "REQUEST_OPERATOR_APPROVAL_TO_ENABLE_YEFFAI_GENERIC_REMOTE_EXECUTOR" }, { "action": "REQUEST_OPERATOR_APPROVAL_TO_EXECUTE_YEFFAI_INSTALL_STEP_001_SERVER_BASELINE_CONFIG", "action_id": "REQUEST_OPERATOR_APPROVAL_TO_EXECUTE_YEFFAI_INSTALL_STEP_001_SERVER_BASELINE_CONFIG", "contract_id": "observable_action_request_operator_approval_to_execute_yeffai_install_step_001_server_baseline_config", "status": "CONTRACTED_BLOCKED", "created_at": "2026-07-01T21:06:35Z", "updated_at": "2026-07-01T21:06:35Z", "authority": "Register the human approval gate for executing YEFFAI STEP 001 through the already-enabled generic Waresites-to-YEFFAI executor. This action is an approval gate only and does not execute remote commands.", "source_contract": "/home/yeff/public_html/devon/canon/execution/state/yeffai_install_step_001_server_baseline_config_contract.json", "executor_contract": "/home/yeff/public_html/devon/canon/execution/state/yeffai_generic_remote_executor_contract.json", "execution_class": "LOCAL_STEP_EXECUTION_APPROVAL_GATE", "remote_mutation_allowed": "NO", "installation_command_allowed": "NO", "step_001_execution_allowed_now": "NO", "step_001_execution_allowed_after_explicit_operator_approval": "YES_LIMITED_TO_STEP_001_CONTRACT", "generic_remote_executor_enabled_required": "NO", "generic_remote_executor_enabled_observed": "NO", "real_shell_execution_enabled_now": "NO_UNTIL_STEP_ACTION_APPROVAL", "remote_yeffai_mutation": "NO", "installation_command_executed": "NO", "installation_started": "NO", "step_001_executed": "NO", "ui_patch_allowed": "NO", "approval_gate_can_set_completion": "NO", "expected_evidence": [ "yeffai_generic_remote_executor_contract.status=ENABLED_PENDING_STEP_APPROVAL", "yeffai_generic_remote_executor_contract.execution_state.generic_remote_executor_enabled=YES", "yeffai_generic_remote_executor_contract.execution_state.real_shell_execution_enabled=NO_UNTIL_STEP_ACTION_APPROVAL", "yeffai_install_step_001_server_baseline_config_contract.next_required_action=REQUEST_OPERATOR_APPROVAL_TO_EXECUTE_YEFFAI_INSTALL_STEP_001_SERVER_BASELINE_CONFIG", "execution_server_integration_plan.next_required_action=REQUEST_OPERATOR_APPROVAL_TO_EXECUTE_YEFFAI_INSTALL_STEP_001_SERVER_BASELINE_CONFIG", "runtime_status.php exposes next_required_action=REQUEST_OPERATOR_APPROVAL_TO_EXECUTE_YEFFAI_INSTALL_STEP_001_SERVER_BASELINE_CONFIG", "completion_display_allowed=NO", "completion=null", "progress=null", "remote_yeffai_mutation=NO", "installation_command_executed=NO", "installation_started=NO", "step_001_executed=NO" ], "validation_rule": { "pass": "PASS when the approval gate is registered, all routes point to it, generic executor is enabled but real shell execution remains blocked, runtime stays pending, and no YEFFAI mutation occurred.", "fail": "FAIL when registration enables shell execution, marks STEP001 executed, starts installation, alters UI progress, corrupts registry, or performs remote mutation.", "missing": "MISSING when registry binding, STEP001 contract, generic executor enabled state, route, runtime field or ledger evidence is absent." }, "failure_rule": "Any attempt to execute STEP001, run SSH mutation, install packages, mark progress, or change YEFFAI during this approval-gate registration is FAIL.", "rollback_rule": "Restore Waresites canon/state backups for registry, gap queue, gap latest, ledger, plan, jobs, generic executor contract/latest and STEP001 contract. No remote rollback exists because this action performs no remote mutation.", "canon_outputs": [ "/home/yeff/public_html/devon/canon/execution/state/execution_observable_contract_registry.json", "/home/yeff/public_html/devon/canon/execution/state/execution_contract_gap_queue.json", "/home/yeff/public_html/devon/canon/execution/state/execution_contract_gap_worker_latest.json", "/home/yeff/public_html/devon/canon/execution/state/execution_ledger.json", "/home/yeff/public_html/devon/canon/execution/state/execution_ledger.jsonl", "/home/yeff/public_html/devon/canon/execution/state/execution_server_integration_plan.json", "/home/yeff/public_html/devon/canon/execution/state/yeffai_bootstrap_jobs.json", "/home/yeff/public_html/devon/canon/execution/state/yeffai_generic_remote_executor_contract.json", "/home/yeff/public_html/devon/canon/execution/state/yeffai_generic_remote_executor_latest.json", "/home/yeff/public_html/devon/canon/execution/state/yeffai_install_step_001_server_baseline_config_contract.json" ], "runtime_fields": [ "next_required_action", "completion_display_allowed", "completion", "completion_percent", "progress", "completion_source", "target_pull_worker_remote_yeffai_mutation", "target_pull_worker_installation_command_executed", "target_pull_worker_installation_started" ], "ui_binding_rule": "UI reads runtime_status.php only. Donut and progress remain PENDING until a later approved STEP001 executor run emits real remote execution evidence.", "approval_phrase_required_before_execution_patch": "APROVO EXECUTAR O STEP 001 NO YEFFAI PELO EXECUTOR GENÉRICO WARESITES", "next_required_action_after_pass": "REQUEST_OPERATOR_APPROVAL_TO_EXECUTE_YEFFAI_INSTALL_STEP_001_SERVER_BASELINE_CONFIG" }, { "action_id": "FIX_TARGET_SSH_AUTH", "status": "PASS", "execution_class": "REMOTE_ACCESS_REPAIR_GATE", "remote_mutation_allowed": "NO", "installation_command_allowed": "NO", "expected_evidence": [ "target_ssh_auth_status=PASS" ], "expected_remote_delta": "NONE", "validation_rule": "Resolved when current runtime target_ssh_auth_status is PASS.", "failure_rule": "OPEN only when current runtime target_ssh_auth_status is FAIL or MISSING.", "rollback_rule": "NO_REMOTE_MUTATION_NO_REMOTE_ROLLBACK_REQUIRED", "canon_outputs": [ "execution_contract_gap_queue.json", "execution_observable_contract_registry.json", "runtime_status.php" ], "runtime_fields": [ "target_ssh_auth_status", "target_host_or_ip" ], "ui_visibility_rule": "Action may appear as Next Action only when its expected evidence is missing.", "created_by_patch": "contract_and_resolve_open_install_gate_gaps", "created_at": "2026-07-07T15:18:19Z" }, { "action_id": "REQUEST_OPERATOR_APPROVAL_TO_ENABLE_YEFFAI_GENERIC_REMOTE_EXECUTOR", "status": "PASS", "execution_class": "SUPERSEDED_OPERATOR_APPROVAL_GATE", "remote_mutation_allowed": "NO", "installation_command_allowed": "NO", "expected_evidence": [ "superseded_by=REQUEST_OPERATOR_APPROVAL_TO_EXECUTE_YEFFAI_INSTALL_STEP_001_SERVER_BASELINE_CONFIG" ], "expected_remote_delta": "NONE", "validation_rule": "Resolved because the generic executor approval gate was superseded by the dedicated Step 001 approval contract.", "failure_rule": "OPEN only if the dedicated Step 001 approval action contract is absent.", "rollback_rule": "NO_REMOTE_MUTATION_NO_REMOTE_ROLLBACK_REQUIRED", "canon_outputs": [ "execution_contract_gap_queue.json", "execution_observable_contract_registry.json", "runtime_status.php" ], "runtime_fields": [ "next_required_action", "yeffai_installation_command_executed", "installation_started" ], "ui_visibility_rule": "Action may appear as Next Action only when its expected evidence is missing.", "created_by_patch": "contract_and_resolve_open_install_gate_gaps", "created_at": "2026-07-07T15:18:19Z", "superseded_by": "REQUEST_OPERATOR_APPROVAL_TO_EXECUTE_YEFFAI_INSTALL_STEP_001_SERVER_BASELINE_CONFIG" }, { "action_id": "VERIFY_YEFFAI_INSTALL_STEP_001_SERVER_BASELINE_CONFIG", "status": "PASS", "execution_class": "READ_ONLY_REMOTE_BASELINE_VERIFICATION", "remote_mutation_allowed": "NO", "installation_command_allowed": "NO", "expected_evidence": [ "target_ssh_auth_status=PASS", "target_live_runtime_status=PASS", "target_live_read_status=PASS", "target_host_or_ip", "target_remote_hostname", "target_remote_whoami", "target_remote_os_pretty" ], "expected_remote_delta": "NONE", "validation_rule": "PASS only when target SSH auth, live runtime and live read are PASS and remote identity fields are present.", "failure_rule": "FAIL when SSH auth, live runtime or live read are FAIL; MISSING when any required remote identity field is absent.", "rollback_rule": "NO_REMOTE_MUTATION_NO_REMOTE_ROLLBACK_REQUIRED", "canon_outputs": [ "execution_contract_gap_queue.json", "execution_observable_contract_registry.json", "runtime_status.php" ], "runtime_fields": [ "target_ssh_auth_status", "target_live_runtime_status", "target_live_read_status", "target_host_or_ip", "target_remote_hostname", "target_remote_whoami", "target_remote_os_pretty", "next_required_action" ], "ui_visibility_rule": "Action may appear as Next Action only when its expected evidence is missing.", "created_by_patch": "contract_and_resolve_open_install_gate_gaps", "created_at": "2026-07-07T15:18:19Z" } ], "last_registered_action": "APPROVE_YEFFAI_TARGET_SIDE_MONITORING_SECURITY_CONTRACT", "last_registered_action_status": "CONTRACTED_APPROVAL_GATE", "last_operator_approval_action": "APPLY_OPERATOR_APPROVAL_ENABLE_YEFFAI_GENERIC_REMOTE_EXECUTOR", "last_operator_approval_status": "PASS", "generic_remote_executor_enabled": "NO", "generic_remote_executor_status": "CONTRACTED_BLOCKED", "last_step001_approval_gate_registered": "REQUEST_OPERATOR_APPROVAL_TO_EXECUTE_YEFFAI_INSTALL_STEP_001_SERVER_BASELINE_CONFIG", "step_001_executed": "NO", "next_required_action": "APPROVE_YEFFAI_TARGET_SIDE_MONITORING_SECURITY_CONTRACT", "runtime_next_required_action": "APPROVE_YEFFAI_TARGET_SIDE_MONITORING_SECURITY_CONTRACT", "plan_next_required_action": "APPROVE_YEFFAI_TARGET_SIDE_MONITORING_SECURITY_CONTRACT", "ledger_required_next_action": "APPROVE_YEFFAI_TARGET_SIDE_MONITORING_SECURITY_CONTRACT", "step001_closure_status": "PASS", "step001_closed": "YES", "target_side_monitoring_security_contract": "/home/yeff/public_html/devon/canon/execution/state/yeffai_target_side_monitoring_security_contract.json", "target_side_monitoring_security_contract_status": "PASS" }