{
  "schema": "router-step-release-v1",
  "step_id": "STEP_050M07P26C1_R02_WIREGUARD_CONFIG_QR_REVOKE_REISSUE_SURFACE",
  "revision": "R02",
  "workflow_contract_version": 2,
  "canonical_zip_required": true,
  "classification": "class_b_vm121_profile_delivery_source_security_change",
  "functional_stage": "p26c1_wireguard_config_qr_revoke_reissue_surface",
  "source_changed": true,
  "live_database_written": false,
  "isolated_database_written": true,
  "database_schema_changed": false,
  "runtime_impact": true,
  "snapshot_required": false,
  "reboot_required": false,
  "external_onboarding_active": false,
  "smtp_tls_delivery_active": false,
  "config_qr_implemented": true,
  "public_config_qr_active": false,
  "external_client_handshake_proven": false,
  "provisioning_source_changed": false,
  "worker_entry": "scripts/run-step.sh",
  "exact_worker_fixture": "tests/exact-worker.sh",
  "target_package_path": "payload/p26c1-profile-surface-package.tar.gz",
  "target_package_sha256": "93e6ab35356baecc025ffe7ebb9c312e3d00c0de5ddef18c2f4a55a51bd1726f",
  "expected_installer_sha256": "bfedae8ffcab7501ba5cd2c66aa0fd16b1b25e1e9da731f2436abba684c8e521",
  "mandatory_fixture_count": 7,
  "target_environment_matrix": "reference/target-environment.tsv",
  "path_ownership_manifest": "reference/path-ownership.tsv",
  "vm121_base_commit": "13f7b33bb28ffa87b3e0294082de1ed5d438f8c2",
  "vm121_base_tree": "57adc457e616133842dca65534deff139f9fd835",
  "vm121_expected_file_count_before": 50,
  "vm121_expected_file_count_after": 51,
  "alembic_target": "0004_profile_provisioning",
  "source_of_truth": "AFTER_P25 Project Sources plus P26/R03 exact STEP evidence and VM121 Machine Git 13f7b33bb28f. P26C1 keeps production DB read-only and proves profile/config/QR/revoke/reissue semantics only against a fail-closed temporary p26c1_* database.",
  "next_action": "P26C2 controlled live external WireGuard proof through authenticated config surface: real lifecycle, handshake/data-plane, revoke, reissue, new handshake, teardown"
}