{
  "contract_id": "yeffai_pre_installation_baseline_decision_gate_contract",
  "version": "v1",
  "created_at": "2026-06-30T16:50:03Z",
  "status": "PASS",
  "current_action": "YEFFAI_PRE_INSTALLATION_BASELINE_DECISION_GATE",
  "next_required_action": "YEFFAI_FIRST_INSTALLATION_STEP_CONTRACT_GATE",
  "execution_class": "LOCAL_DECISION_GATE",
  "target_ssh_alias": "YEFFAI",
  "target_host_or_ip": "157.173.100.205",
  "observed_identity": {
    "hostname": "vmi2858754",
    "fqdn": "vmi2858754.contaboserver.net",
    "whoami": "root",
    "id": "0:0"
  },
  "readiness_source": "/home/yeff/public_html/devon/canon/execution/state/yeffai_post_reboot_readiness_audit_latest.json",
  "remote_mutation_allowed": "NO",
  "reboot_executed_by_devon": "NO_BY_DEVON",
  "installation_command_allowed": "NO",
  "installation_started": "NO",
  "decision": {
    "baseline_ready_for_step_contract": "YES",
    "installation_execution_allowed_now": "NO",
    "requires_child_installation_step_contract": "YES",
    "requires_security_review_before_public_exposure": "YES",
    "first_child_contract_gate": "YEFFAI_FIRST_INSTALLATION_STEP_CONTRACT_GATE"
  },
  "accepted_baseline": {
    "reboot_required": "NO",
    "apt_lock_status": "FREE",
    "opt_exists": "YES",
    "opt_yeffai_exists": "NO",
    "docker_bin": "NO",
    "docker_compose_plugin": "NO",
    "nginx_bin": "NO",
    "ufw_bin": "YES",
    "ufw_status": "Status: inactive"
  },
  "required_next_contract": {
    "must_define": [
      "exact remote command list",
      "expected remote delta",
      "pre-command read-only guard",
      "post-command evidence",
      "timeout behavior",
      "rollback or recovery boundary",
      "runtime/UI binding",
      "no unrelated package installation"
    ],
    "must_not_do": [
      "run installation directly from this gate",
      "combine firewall exposure with package baseline install",
      "ignore UFW inactive security review",
      "execute unregistered actions"
    ]
  },
  "validation_rule": {
    "pass": "PASS when readiness audit is PASS, no blockers exist, and installation remains not started.",
    "fail": "FAIL if this gate executes remote commands or installation.",
    "missing": "MISSING if first child installation contract is absent."
  },
  "failure_rule": "Block installation until a dedicated first installation step contract is created and validated.",
  "rollback_rule": "Restore Waresites canon/state backup. No remote rollback exists because no remote mutation occurs.",
  "runtime_fields": [
    "next_required_action",
    "contract_gap_status",
    "contract_gap_open_count",
    "target_pull_worker_installation_started",
    "target_pull_worker_installation_command_executed"
  ],
  "ui_visibility_rule": "Render as baseline decision gate completed and waiting for first installation step contract."
}