{
  "schema": "router-step-release-v1",
  "step_id": "STEP_050M07P26C3A_R01_SMTP_TLS_AND_DURABLE_ADMIN_SECRET_FOUNDATION",
  "revision": "R01",
  "workflow_contract_version": 2,
  "canonical_zip_required": true,
  "classification": "class_b_vm121_smtp_tls_and_durable_admin_secret_foundation",
  "functional_stage": "p26c3a_smtp_tls_and_durable_admin_secret_foundation",
  "source_changed": true,
  "live_database_written": false,
  "database_schema_changed": false,
  "runtime_impact": true,
  "snapshot_required": false,
  "reboot_required": false,
  "external_onboarding_active": false,
  "smtp_tls_implemented": true,
  "smtp_tls_delivery_active": false,
  "smtp_secret_provisioned": false,
  "durable_admin_auth_implemented": true,
  "durable_admin_auth_active": false,
  "admin_secret_provisioned": false,
  "real_smtp_delivery_proven": false,
  "worker_entry": "scripts/run-step.sh",
  "exact_worker_fixture": "tests/exact-worker.sh",
  "target_package_path": "payload/p26c3a-source-package.tar.gz",
  "target_package_sha256": "717adde8187ed66dbfbb657190be74963a8e9480f8651719a2360dff95edf926",
  "expected_installer_sha256": "fadb93105a76029ab4ef717ea31626d6f6977b5978c40da363f506fe090f471d",
  "mandatory_fixture_count": 7,
  "target_environment_matrix": "reference/target-environment.tsv",
  "path_ownership_manifest": "reference/path-ownership.tsv",
  "vm121_base_commit": "9bbb2aeacd669698055121a0f4fbaf5aa67720db",
  "vm121_base_tree": "f83f404ca097962b1d407ad5b3c32da96acd4ee4",
  "vm121_expected_file_count_before": 51,
  "vm121_expected_file_count_after": 53,
  "alembic_target": "0004_profile_provisioning",
  "source_of_truth": "AFTER_P25 Project Sources plus exact P26/R03, P26C1/R03, P26C2/R03 evidence and VM121 Machine Git 9bbb2aeacd66. This STEP adds only source-level strict SMTP/TLS delivery and file-first durable admin authorization boundaries; production DB, live .env, VM100 and VM101 are not mutated.",
  "next_action": "P26C3B provision root-only admin/SMTP secrets plus exact SMTP host/from/public magic-link URL, then prove real TLS mail delivery before P27"
}