{
  "contract_id": "yeffai_install_step_001_server_baseline_config_contract",
  "version": "v1.0",
  "status": "PASS",
  "created_at": "2026-06-30T19:52:19Z",
  "created_by_action": "GENERATE_FIRST_DEDICATED_INSTALLATION_STEP_CONTRACT_SAFE_NO_EXIT",
  "run_on": "WARESITES",
  "target": {
    "name": "YEFF AI",
    "ssh_alias": "YEFFAI",
    "ip": "157.173.100.205",
    "remote_mutation_allowed_now": "NO",
    "remote_mutation_allowed_after_explicit_user_approval": "NO"
  },
  "current_gate_before_contract": "YEFFAI_FIRST_INSTALLATION_STEP_CONTRACT_GATE",
  "next_required_action": "VERIFY_YEFFAI_INSTALL_STEP_001_SERVER_BASELINE_CONFIG",
  "step": {
    "step_id": "001",
    "title": "YEFF AI server baseline configuration",
    "approval_gate_action": "YEFFAI_INSTALL_STEP_001_SERVER_BASELINE_CONFIG_APPROVAL_GATE",
    "execute_action": "YEFFAI_INSTALL_STEP_001_SERVER_BASELINE_CONFIG_EXECUTE",
    "verify_action": "YEFFAI_INSTALL_STEP_001_SERVER_BASELINE_CONFIG_VERIFY",
    "execution_allowed_now": "NO",
    "requires_explicit_user_approval": "YES",
    "package_install_allowed": "NO",
    "reboot_allowed": "NO",
    "public_exposure_allowed": "NO",
    "starts_yeffai_application": "NO"
  },
  "allowed_after_approval": {
    "local_commands_on_yeffai": [
      "mkdir -p /opt/yeffai/runtime /opt/yeffai/state /opt/yeffai/logs /opt/yeffai/backup /opt/yeffai/contracts /opt/yeffai/evidence",
      "chmod 750 /opt/yeffai",
      "test -d /opt/yeffai",
      "test -d /opt/yeffai/runtime",
      "test -d /opt/yeffai/state",
      "test -d /opt/yeffai/logs",
      "test -d /opt/yeffai/backup",
      "test -d /opt/yeffai/contracts",
      "test -d /opt/yeffai/evidence"
    ]
  },
  "blocked_in_this_step": {
    "apt_install": "YES",
    "docker_install": "YES",
    "nginx_install": "YES",
    "ufw_public_allow": "YES",
    "systemd_service_enable": "YES",
    "reboot": "YES",
    "start_application": "YES"
  },
  "approval_phrase": "APROVO O STEP 001 DE CONFIGURAÇÃO BASE DO SERVIDOR YEFF AI",
  "next_patch_after_user_approval": "EXECUTE_YEFFAI_INSTALL_STEP_001_SERVER_BASELINE_CONFIG_FROM_WARESITES",
  "deferred_until": "STEP_000_SERVER_OS_UPDATE_VERIFY_PASS",
  "predecessor_step": "YEFFAI_INSTALL_STEP_000_SERVER_OS_UPDATE",
  "updated_at": "2026-07-07T21:45:17.557818+00:00",
  "control_plane_communication_model": {
    "model_id": "YEFFAI_STEP001_CONTROL_PLANE_PULL_ONLY_NO_REVERSE_CHANNEL",
    "status": "PASS",
    "updated_at": "2026-07-01T20:11:07Z",
    "scope": "communication_model_before_step001_remote_execution",
    "control_plane": "waresites",
    "target_server": "YEFFAI",
    "authorized_direction_now": "WARESITES_TO_YEFFAI_READ_ONLY_PULL",
    "waresites_to_yeffai_ssh_status": "EXISTS_AND_PROVEN_BY_AUDIT",
    "yeffai_to_waresites_reverse_channel_required_now": "NO",
    "yeffai_to_waresites_reverse_channel_enabled": "NO",
    "reverse_ssh_tunnel_allowed": "NO",
    "reverse_push_agent_allowed_now": "NO",
    "public_callback_endpoint_allowed_now": "NO",
    "reason": "The current panel can observe YEFFAI through Waresites-initiated read-only SSH pull. Enabling reverse communication before a dedicated contract would increase attack surface and is not required for STEP001 readiness.",
    "ui_progress_rule": "Donut and progress lines must remain bound to canonical runtime evidence generated from real remote execution or validation evidence, never from approval gates or manual UI patches.",
    "current_runtime_expectation_before_execution": {
      "completion_display_allowed": "NO",
      "completion": null,
      "completion_percent": null,
      "progress": null,
      "visual_label": "PENDING"
    },
    "future_reverse_channel_requirements_if_needed": {
      "separate_contract_required": "YES",
      "separate_operator_approval_required": "YES",
      "mTLS_or_signed_payload_required": "YES",
      "short_lived_token_required": "YES",
      "allowlisted_event_schema_required": "YES",
      "ledger_event_required": "YES",
      "rate_limit_required": "YES",
      "no_remote_shell_from_yeffai_to_waresites": "YES",
      "no_unrestricted_callback_endpoint": "YES"
    },
    "safe_next_architecture_step": "Create or enable a generic Waresites-controlled remote execution worker only after contract validation; do not create per-step UI patches and do not enable YEFFAI reverse channel."
  },
  "yeffai_to_waresites_reverse_channel_required_now": "NO",
  "yeffai_to_waresites_reverse_channel_enabled": "NO",
  "reverse_channel_policy": "BLOCKED_UNTIL_SEPARATE_CONTRACT_AND_OPERATOR_APPROVAL",
  "authorized_communication_direction_now": "WARESITES_TO_YEFFAI_READ_ONLY_PULL",
  "manual_ui_progress_patch_allowed": "NO",
  "remote_mutation_policy": "READ_ONLY_SCAN",
  "installation_command_executed": "YES",
  "installation_started": "YES",
  "remote_yeffai_mutation": "YES",
  "generic_remote_executor_contract_status": "CONTRACTED_BLOCKED",
  "generic_remote_executor_contract_path": "/home/yeff/public_html/devon/canon/execution/state/yeffai_generic_remote_executor_contract.json",
  "step001_execution_blocked_until_generic_executor_enabled": "NO",
  "next_required_action_source": "execution_observable_contract_registry",
  "generic_remote_executor_enabled": "NO",
  "generic_remote_executor_status": "CONTRACTED_BLOCKED",
  "operator_approval_applied": "YES_FOR_STEP001",
  "step_001_executed": "YES",
  "step001_execution_approval_gate_registered": "YES",
  "step001_execution_approval_gate_status": "CONTRACTED_BLOCKED",
  "real_shell_execution_enabled": "NO",
  "step001_operator_approval_packet_status": "PENDING_OPERATOR_APPROVAL",
  "step001_operator_approval_packet_path": "/home/yeff/public_html/devon/canon/execution/state/yeffai_install_step_001_operator_approval_packet.json",
  "step001_approval_phrase_required_exact": "APROVO EXECUTAR O STEP 001 NO YEFFAI PELO EXECUTOR GENÉRICO WARESITES",
  "step001_execution_approved": "YES",
  "contract_gap_status": "PASS",
  "contract_gap_policy": "BLOCK_UNCONTRACTED_EXECUTION",
  "operator_approval_supplied_in_chat": "YES",
  "step001_execution_status": "PASS",
  "step001_execution_approved_at": "2026-07-01T21:33:57Z",
  "approval_phrase_applied_exact": "APROVO EXECUTAR O STEP 001 NO YEFFAI PELO EXECUTOR GENÉRICO WARESITES",
  "step_001_executed_at": "2026-07-01T21:33:57Z",
  "remote_evidence_path": "/home/yeff/public_html/devon/_backup/patch_execute_step001_yeffai_server_baseline_config_20260701_183313/remote_step001_evidence_20260701_183313.json",
  "project_progress_state": "/home/yeff/public_html/devon/canon/execution/state/execution_project_progress_runtime.json",
  "step_registry_state": "/home/yeff/public_html/devon/canon/execution/state/yeffai_execution_step_registry.json",
  "project_progress_percent_exact": 1.0526,
  "project_progress_percent_display": 1,
  "completion_source": "execution_project_progress_runtime",
  "last_readonly_verification_status": "PASS",
  "last_readonly_verification_at": "2026-07-07T17:11:47Z",
  "last_readonly_verification_source": "rerun_step001_baseline_with_identityfile_readonly",
  "last_readonly_verification_auth_key": "/root/.ssh/yeffai_devon_target_ed25519",
  "last_readonly_verification_mutation": "NO",
  "last_execution_evidence_path": "/home/yeff/public_html/devon/canon/execution/state/yeffai_install_step_001_server_baseline_config_execution_evidence.json",
  "last_execution_at": "2026-07-07T19:52:23.562859+00:00",
  "runtime_next_required_action": "VERIFY_YEFFAI_INSTALL_STEP_001_SERVER_BASELINE_CONFIG",
  "plan_next_required_action": "VERIFY_YEFFAI_INSTALL_STEP_001_SERVER_BASELINE_CONFIG",
  "ledger_required_next_action": "VERIFY_YEFFAI_INSTALL_STEP_001_SERVER_BASELINE_CONFIG",
  "step001_closure_status": "PASS",
  "step001_closed": "YES"
}