{
  "schema_version": "vignette.nas-preview-g8-actual-rollback.v1",
  "recorded_at_kst": "2026-08-07T21:15:00+09:00",
  "run_id": "20260807g8a",
  "scope": "isolated NAS preview only; public runtime untouched",
  "target": {
    "compose_project": "vignette-preview-20260807",
    "remote_root": "/volume1/docker/vignette-preview-20260807",
    "preview_url": "http://100.116.83.60:8088",
    "health_url": "http://127.0.0.1:8088/api/health",
    "db_ip": "172.22.0.2",
    "db_role": "vignette_app",
    "db_name": "vignette_preview"
  },
  "gate1_preconditions": {
    "current_api_image": "sha256:52e0e816c47b1152368113b186d5cdb971123bc0961122541a7becf430b88b2d",
    "current_web_image": "sha256:6fdbb6460a7617540fa3ceff7eba96a2b9d83678318f0e27f99ac4bd7d93f215",
    "previous_api_image": "sha256:79ec731f6bcdb79850507f5b711930a710e2d8e82276e3ea61dc8e4a60e04450",
    "previous_web_image": "sha256:c530213f4f8b23f228b2999df0c3653173cfa6939b6abb476f17df7488462f28",
    "manifest_sha256": "eeb8edc060e920195e083399814b9594c4d88e3d534daa39facd6c895f9e8ef2",
    "rollback_old_plan_sha256": "1ba0af237b83ace5572b49d699b2fd81bc6b46752cb86317c4d013f8a8f6aa6f",
    "restore_current_plan_sha256": "9ee8ecca9f712bce96592e9b88f30b24fc2c71c220022efcba95a85316cd3309",
    "executor_script_sha256": "07ea4ff348b5b96959c9411123c0c8519f22cc972a7c78ecb5f5e40ae88093d7",
    "probe_script_sha256": "74d4b80b031106c620f36dffc7d7a99667f1eda23333dbdb9e7e75e3ec5bab68",
    "preproof_dump_sha256": "92ed4736c1b21081e7ce1dc16aa0d026456d7683fd550077136d3de736c1570f",
    "preproof_dump_bytes": 960970,
    "listeners_18149_8018": 0,
    "helper_containers": 0,
    "health": "ok/db=true/engine=true"
  },
  "gate6_helper_isolation": {
    "contract": "membership, not compose-label absence",
    "rationale": "the audited current API image carries com.docker.compose.* image labels, so a zero-key rule can never hold while the audited runtime image is reused",
    "implementation": "scripts/launch-nas-preview-g8-helpers.py",
    "tests": "scripts/test_launch_nas_preview_g8_helpers.py 37/37 PASS",
    "image_baseline_compose_labels": {
      "com.docker.compose.project": "vignette-preview-20260807",
      "com.docker.compose.service": "api",
      "com.docker.compose.version": "2.20.1"
    },
    "inherited_compose_labels": {
      "com.docker.compose.version": "2.20.1"
    },
    "isolated_project": "vignette-g8-helper-20260807g8a",
    "target_project_members_during_proof": [
      "vignette-preview-20260807-api-1",
      "vignette-preview-20260807-db-1",
      "vignette-preview-20260807-proxy-1",
      "vignette-preview-20260807-web-1"
    ],
    "helpers": [
      {
        "role": "executor",
        "container_name": "g8-rollback-executor-20260807g8a",
        "container_id": "5f5f3295f57fe9e8ccb61b719d31d0cdfca54730510ab811d95fcc9163b2785c",
        "isolated_service": "g8-rollback-executor",
        "hardening": "network=host, readonly rootfs, cap-drop ALL, no-new-privileges, user 1028:100, group-add 101, pids-limit 256, restart=no",
        "bind": "127.0.0.1:18149",
        "unauth_healthz_status": 403,
        "token_healthz_status": 200,
        "unauth_rollback_post_status": 403
      },
      {
        "role": "control-plane",
        "container_name": "g8-rollback-control-plane-20260807g8a",
        "container_id": "ba545c633dd2074b0a31889019b6d10fbe60776de8881b161bfb084f835025df",
        "isolated_service": "g8-rollback-control-plane",
        "bind": "127.0.0.1:8018",
        "health_status": 200,
        "unauth_auth_me_status": 401,
        "producer_enabled": false,
        "distinct_lifecycle_from_preview_api": true
      },
      {
        "role": "probe",
        "plan": "rollback-old",
        "container_name": "g8-rollback-probe-20260807g8a",
        "container_id": "15c385c86db05461a61001ecdf38d693f31e4cdd1d8f0e5e2c7f62933f2fa56e",
        "isolated_service": "g8-rollback-probe",
        "docker_socket_mounted": false,
        "exit_code": 0
      },
      {
        "role": "probe",
        "plan": "restore-current",
        "container_name": "g8-rollback-probe-20260807g8a",
        "container_id": "af079155c9b217f6c271bda03ebfe49ac99a5d8febc769d9cb088ada42ad289f",
        "isolated_service": "g8-rollback-probe",
        "docker_socket_mounted": false,
        "exit_code": 0
      }
    ]
  },
  "planned_step_deviation": {
    "planned": "Windows SSH tunnel 127.0.0.1:18018 to NAS 127.0.0.1:8018, probe executed from Windows",
    "observed": "NAS sshd refused direct-tcpip with 'administratively prohibited: open failed'",
    "action": "probe executed from an isolated NAS-side helper container against NAS loopback 127.0.0.1:8018",
    "contract_preserved": "control-plane origin http://127.0.0.1:8018 differs from preview origin http://127.0.0.1:8088; the probe still enforces main_preview_self_rollback_forbidden",
    "nas_sshd_config_changed": false
  },
  "executions": [
    {
      "plan": "rollback-old",
      "probe_id": "nas-g8-probe-51c203e09baf9957a571e915",
      "plan_sha256": "3cdbe07193ae17f96ead11f930db7bb085648de2b75aa19b595733650389bf27",
      "executor_receipt_id": "nas-g8-723eeef22eab05e63e3fafb0",
      "artifact_id": "vignette-preview-release-a8c27b0aadcb9dac",
      "artifact_sha256": "a8c27b0aadcb9dacea86c4be5e62e19277b9cc2678ebca51aa02998d2c2d1a0d",
      "lifecycle_status": "executed",
      "release_gate_idempotent_replay": true,
      "approval_idempotent_replay": true,
      "binding_verified": true,
      "control_plane_separation_verified": true,
      "started_at_utc": "2026-08-07T12:04:31+00:00",
      "executed_at_utc": "2026-08-07T12:05:11+00:00",
      "images_before": {
        "api": "sha256:52e0e816c47b1152368113b186d5cdb971123bc0961122541a7becf430b88b2d",
        "web": "sha256:6fdbb6460a7617540fa3ceff7eba96a2b9d83678318f0e27f99ac4bd7d93f215"
      },
      "images_after": {
        "api": "sha256:79ec731f6bcdb79850507f5b711930a710e2d8e82276e3ea61dc8e4a60e04450",
        "web": "sha256:c530213f4f8b23f228b2999df0c3653173cfa6939b6abb476f17df7488462f28"
      },
      "health_checks_after": 3,
      "health_ok_after": 3,
      "result_file_sha256": "54e156fee3fb2b37fe92e7fba845cc02db1887d29e5c3cfd2ca0045942ddf95e"
    },
    {
      "plan": "restore-current",
      "probe_id": "nas-g8-probe-3fc9052ae1f4577a316db010",
      "plan_sha256": "050d2c72d176bf5e6426de837e0c6a98a85c08789411159d7681b4c4e5c07ca5",
      "executor_receipt_id": "nas-g8-2738846cf2cf4fbe8ce0fc26",
      "artifact_id": "vignette-preview-release-6030a677af7e87cb",
      "artifact_sha256": "6030a677af7e87cbfabc422b553d108d53414fd3c446548734a13b036d35c611",
      "lifecycle_status": "executed",
      "release_gate_idempotent_replay": true,
      "approval_idempotent_replay": true,
      "binding_verified": true,
      "control_plane_separation_verified": true,
      "started_at_utc": "2026-08-07T12:06:06+00:00",
      "executed_at_utc": "2026-08-07T12:06:42+00:00",
      "images_before": {
        "api": "sha256:79ec731f6bcdb79850507f5b711930a710e2d8e82276e3ea61dc8e4a60e04450",
        "web": "sha256:c530213f4f8b23f228b2999df0c3653173cfa6939b6abb476f17df7488462f28"
      },
      "images_after": {
        "api": "sha256:52e0e816c47b1152368113b186d5cdb971123bc0961122541a7becf430b88b2d",
        "web": "sha256:6fdbb6460a7617540fa3ceff7eba96a2b9d83678318f0e27f99ac4bd7d93f215"
      },
      "health_checks_after": 3,
      "health_ok_after": 3,
      "result_file_sha256": "c2f535aa3bfb459ddd1395e21b8ebbea0c3ac6252bbb5cd4217c845cab443825"
    }
  ],
  "journal": {
    "path": "/volume1/docker/vignette-preview-20260807/.rollback-executor/journal.jsonl",
    "schema_version": "vignette.nas-preview-rollback-journal.v1",
    "records": 6,
    "events": ["started", "prepared", "executed", "started", "prepared", "executed"],
    "hash_chain_verified": true,
    "sha256": "a5594feb848d33e8ebfe52e55dc2802ba03d3161690b71724ec50fb779470690",
    "integrity_key_id": "6d2f7a5169406e2a",
    "record_hashes": [
      "3a694e813d98811ef6132e159e65f6d980ff16f6495696b165079672734187f4",
      "6748e27bbae655386ef4f73c8bea18cae30d6b9ccc0385a73e9b8df59acb4fab",
      "7142488d0935b755af33f21675e938f5dda93bb1d268a99feb46bbf4f53ccea4",
      "dba76366e9e544f8edfc3a5c532484d0de2b9d4d0b8f98b13e335c980401cd12",
      "cd585370680b0882c8ac775e6cc870c70b005b5c146c17f16a283902fff39878",
      "34ca44ba32dd9b03b630fc43301addb14bc1a711bbb5551a7081f721d417ac5c"
    ]
  },
  "db_lifecycle_aggregate": {
    "measured_as": "table owner role, RLS bypassed for counting only",
    "before": {
      "app_user": 11,
      "sessions": 10,
      "turns": 14,
      "auth_session": 12,
      "g8_lifecycle_tables_nonzero": 0
    },
    "after": {
      "app_user": 12,
      "sessions": 10,
      "turns": 14,
      "auth_session": 14,
      "app.ci_release_gate": 2,
      "app.ci_gate_artifact": 8,
      "app.ci_ingestion_submission": 4,
      "audit.ci_human_approval_event": 2,
      "audit.ci_lifecycle_event": 2,
      "other_ci_tables": 0
    },
    "lifecycle_breakdown": {"rollback/executed": 2},
    "approval_breakdown": {"authorize_rollback/release_gate": 2},
    "release_gate_state": {"pending_human_approval/qualified": 2},
    "silent_auto_promotion": 0,
    "executor_receipt_ids_bound_in_db": [
      "nas-g8-2738846cf2cf4fbe8ce0fc26",
      "nas-g8-723eeef22eab05e63e3fafb0"
    ]
  },
  "post_state": {
    "helper_containers": 0,
    "listeners_18149_8018_18018": 0,
    "target_project_members": 4,
    "api_image": "sha256:52e0e816c47b1152368113b186d5cdb971123bc0961122541a7becf430b88b2d",
    "web_image": "sha256:6fdbb6460a7617540fa3ceff7eba96a2b9d83678318f0e27f99ac4bd7d93f215",
    "health_checks": 3,
    "health_ok": 3,
    "openapi_paths": 126,
    "auth_me_status": 401,
    "web_root_status": 200,
    "override_temp_files": 0,
    "helper_env_files_remaining": 0,
    "compose_down_executed": false,
    "volume_rm_executed": false,
    "prune_executed": false,
    "public_runtime_mutated": false,
    "public_runtime_note": "the public stack (vignette.chanpaca.net, api origin 127.0.0.1:8001, container vignette-dev-db, volume vignette_recovered_prod_20260807) was only read, never restarted, reconfigured or written to"
  },
  "post_rollback_runtime_verification": {
    "test": "session-persistence: persists the browser SSE stream into DB-backed review",
    "project": "chromium-single-run",
    "target": "http://100.116.83.60:8088",
    "result": "passed",
    "duration_seconds": 35.0,
    "physical_microphone_used": false,
    "route_mocks": 0,
    "note": "run after restore-current, so the restored runtime is proven to serve a real browser session end to end"
  },
  "safety_scan": {
    "secrets": 0,
    "emails": 0,
    "cookies": 0,
    "non_deterministic_uuids": 0,
    "note": "every UUID in the preserved probe results is a uuid5 value derived from the repo-fixed probe namespace and the plan suffix; no account, session or personal identifier is recorded"
  }
}