{
  "contract_id": "yeffai_controlled_installation_precheck_step_contract",
  "version": "v1",
  "created_at": "2026-06-30T14:42:56Z",
  "status": "PASS",
  "specific_child_step_id": "YEFFAI_CONTROLLED_INSTALLATION_PRECHECK",
  "parent_gate_action": "BEGIN_CONTROLLED_YEFFAI_INSTALL_STEPS_OR_PROVIDE_CATEGORY_RUNTIME_EVIDENCE",
  "execution_class": "READ_ONLY",
  "target_server": "YEFFAI",
  "target_host_or_ip": "157.173.100.205",
  "target_ssh_alias": "YEFFAI",
  "mutation_scope": "NONE",
  "remote_mutation_allowed": "NO",
  "installation_command_allowed": "NO",
  "authorized_command_template": "ssh YEFFAI '<read-only precheck commands only: OS, apt lock, disk, memory, reboot-required, /opt/yeffai absence, docker/nginx/firewall status>'",
  "expected_remote_delta": [],
  "expected_evidence": [
    "REMOTE_HOSTNAME=YeffAI",
    "REMOTE_WHOAMI=root",
    "REMOTE_OS_PRETTY",
    "REBOOT_REQUIRED",
    "ROOT_DISK",
    "MEMORY_STATUS",
    "APT_LOCK_STATUS",
    "OPT_YEFFAI_EXISTS",
    "DOCKER_BIN",
    "NGINX_BIN",
    "UFW_STATUS",
    "PRECHECK_STATUS",
    "UFW_STATUS_NORMALIZED"
  ],
  "rollback_rule": "No remote rollback because this child step is read-only. Restore Waresites canon/state backup if local state update fails.",
  "scanner_rule": "Run read-only SSH precheck and write local canon evidence before any installation child step can be contracted.",
  "runtime_binding_rule": "Expose precheck status through canon/state and runtime_status.php only after the precheck job produces evidence.",
  "ui_operator_label": "Controlled installation precheck",
  "canon_outputs": [
    "yeffai_controlled_installation_precheck_step_contract.json",
    "yeffai_bootstrap_jobs.json",
    "execution_ledger.json",
    "execution_ledger.jsonl"
  ],
  "required_before_remote_mutation": [
    "contract_gap_open_count=0",
    "precheck_job_status=PASS",
    "gate_contract_status=PASS",
    "rollback_rule_present=YES",
    "expected_remote_delta_defined=YES",
    "human approval if next step mutates YEFF AI"
  ],
  "remote_yeffai_mutation": "NO",
  "installation_command_executed": "NO",
  "installation_started": "NO",
  "ufw_status_empty_output_policy": {
    "status": "PASS",
    "rule": "If UFW_BIN=YES and the raw ufw status command returns an empty first line, normalize UFW_STATUS to UNKNOWN_EMPTY_OUTPUT and keep raw value in UFW_STATUS_RAW.",
    "reason": "The precheck requires an observable firewall field, but empty ufw output is an observed read-only command result, not remote mutation and not installation failure.",
    "validation": "PASS when UFW_STATUS is non-empty after normalization and UFW_STATUS_RAW is preserved."
  },
  "updated_at": "2026-06-30T15:01:57Z"
}