{
  "contract_id": "yeffai_firewall_inactive_security_review_contract",
  "version": "v1",
  "created_at": "2026-06-30T15:21:04Z",
  "status": "PASS",
  "risk_id": "UFW_INACTIVE",
  "execution_class": "SECURITY_REVIEW",
  "target_server": "YEFFAI",
  "target_host_or_ip": "157.173.100.205",
  "target_ssh_alias": "YEFFAI",
  "remote_mutation_allowed": "NO",
  "installation_command_allowed": "NO",
  "installation_started": "NO",
  "observed_evidence": {
    "ufw_bin": "YES",
    "ufw_status": "Status: inactive",
    "ufw_status_normalized": "NO"
  },
  "policy": "Firewall policy must be contracted before public exposure, web service publication, reverse proxy activation or any network-facing go-live step.",
  "validation_rule": {
    "pass": "PASS as a pre-install security review item because UFW inactive does not block read-only evidence or local contract creation.",
    "blocking_if": [
      "public port exposure",
      "reverse proxy activation",
      "go-live",
      "external service publication"
    ]
  },
  "rollback_rule": "No remote rollback because this review is local only."
}