{
  "schema": "router-step-release-v1",
  "step_id": "STEP_050M07P26C2_R02_CONTROLLED_LIVE_EXTERNAL_WIREGUARD_PROOF",
  "revision": "R02",
  "workflow_contract_version": 2,
  "canonical_zip_required": true,
  "classification": "class_c_controlled_live_external_wireguard_test",
  "functional_stage": "p26c2_controlled_live_external_wireguard_proof",
  "source_changed": false,
  "live_database_written": true,
  "database_schema_changed": false,
  "runtime_impact": true,
  "snapshot_required": false,
  "reboot_required": false,
  "runtime_provisioning_active": false,
  "external_onboarding_active": false,
  "config_qr_implemented": true,
  "public_config_qr_active": false,
  "external_client_handshake_proven": false,
  "smtp_tls_delivery_active": false,
  "encrypted_database_backup_required": true,
  "backup_restore_proof_required": true,
  "worker_entry": "scripts/run-step.sh",
  "exact_worker_fixture": "tests/exact-worker.sh",
  "target_package_path": "payload/p26c2-controlled-live-package.tar.gz",
  "target_package_sha256": "23febc0662dfd12b657f43588b4689423a73bc3eb4b37491817d596db5349eec",
  "expected_installer_sha256": "281261306992b1e5cc5b954fae4cbe4564d2715f83f6156a77300e3e5f9185d6",
  "mandatory_fixture_count": 7,
  "target_environment_matrix": "reference/target-environment.tsv",
  "path_ownership_manifest": "reference/path-ownership.tsv",
  "vm100_base_commit": "8c5d11b7e4b119757ea16b46775b26e0ac903d7c",
  "vm100_base_tree": "f25aab0f1886647b52a11ccebe080894bd06542a",
  "vm100_expected_file_count": 34,
  "vm101_base_commit": "94a1c5627bacf9212d3fb2af1a77507ec57ff74b",
  "vm101_base_tree": "ee4dddf35e308096d6496a4ecc25268ebcb3058a",
  "vm101_expected_file_count": 59,
  "vm121_base_commit": "9bbb2aeacd669698055121a0f4fbaf5aa67720db",
  "vm121_base_tree": "f83f404ca097962b1d407ad5b3c32da96acd4ee4",
  "vm121_expected_file_count": 51,
  "alembic_target": "0004_profile_provisioning",
  "source_of_truth": "AFTER_P25 Project Sources plus exact P25/R02, P26/R03, P26C1/R03 evidence, current VM121 Machine Git 9bbb2aeacd66, current Access Map DDN path ssh home-vm100, and P26C2/R01 STOP evidence. R02 changes no source/schema; it moves only the ephemeral client from in-studio VM121 to the true external DDN home-vm100 origin.",
  "next_action": "P26C3 production SMTP/TLS magic-link delivery and durable admin authorization boundary before first trusted-user P27 pilot",
  "continuation_of": "STEP_050M07P26C2_R01_CONTROLLED_LIVE_EXTERNAL_WIREGUARD_PROOF",
  "continuation_reason": "R01 proved authenticated profile creation, VM100 lifecycle/selector and config delivery but the client originated on in-studio VM121 and could not establish the public-endpoint handshake; cleanup PASS. R02 keeps product/runtime semantics unchanged and executes the client from external DDN home-vm100 through the delivered public endpoint.",
  "external_client_handshake_target": true,
  "external_client_host": "home-vm100"
}