{
  "active_origin": "https://portal-investidor.test",
  "existing_http_origin": "http://portal-investidor.test",
  "qa_origin": "https://country02-qa.test:18443",
  "code_hash": "162daff6ce08117582dd7d796639d02b156d1b940cd85ef3587ff88a65747edd",
  "production_manifest_sha256": "d172b5c4f1a1cb2df504b4acd50c687825b8cda970225a02a56e6286b3a13dd5",
  "baseline": {
    "active_vhost": {
      "path": "C:\\laragon\\etc\\apache2\\sites-enabled\\auto.portal-investidor.test.conf",
      "sha256": "21e0635f8153e68c4abc623ef934ed5959870db99160515f9ef926c4ab9f7361"
    },
    "apache_config": {
      "path": "C:\\laragon\\bin\\apache\\httpd-2.4.54-win64-VS16\\conf\\httpd.conf",
      "sha256": "985954a801d6e49e56f81a6d81a8894716d1221c1b311d42e67eb8840f8bf68d"
    },
    "ssl_include": {
      "path": "C:\\laragon\\etc\\apache2\\httpd-ssl.conf",
      "sha256": "0b282b4c1b3842542e8e8f0aad533b7dc6985973c1be5a44706c2ba73e1bd233"
    },
    "active_manifest_sha256": "75352185c2a85c34ab726613db864a598e301a5b342ebbc80ac8e678eed17a94"
  },
  "certificate_required": {
    "SAN": [
      "portal-investidor.test"
    ],
    "EKU": "serverAuth",
    "trusted_chain": "CA local/organizacional aceite nos browsers que usam este hostname local; NÃO reutilizar a CA QA nem o seu certificado",
    "private_key_location": "C:/Users/macbook/.config/investmoz/tls/portal-investidor.test-key.pem",
    "fullchain_location": "C:/Users/macbook/.config/investmoz/tls/portal-investidor.test-fullchain.pem",
    "prepared_not_installed": true,
    "prepared_not_trusted": true,
    "issuer": "CN=InvestMoz portal-investidor.test local 20261011",
    "root_thumbprint": "7D30D7FB226481B6243051309818CF426AF6B6B7",
    "root_sha256": "e32863af4a400dc21b513a24598b31425f74d31119116aaf913de95c0ddc9ef3",
    "leaf_sha256": "df368329204106b6a182c79e7e5c98a8e73890479cb7bca7c3d0928076a60ed5",
    "leaf_valid_until": "2027-01-09T07:49:24+00:00",
    "root_valid_until": "2027-10-11T07:49:24+00:00",
    "private_key_public_key_matches": true,
    "private_key_kept_out_of_bundle": true,
    "signing_key_not_persisted": true,
    "deployment_private_directory": "C:/Users/macbook/.config/investmoz/tls",
    "active_trust_store_changed": false,
    "qa_ca_not_reused": true,
    "renewal": "Before leaf expiry prepare new certificate and trust chain, review/retest before replacement. If using an organization CA instead, seal another configuration hash before applying."
  },
  "application_values": {
    "APP_URL": "https://portal-investidor.test",
    "SESSION_COOKIE": "portal_investidor_https",
    "SESSION_SECURE_COOKIE": true,
    "SESSION_DOMAIN": null,
    "SESSION_PATH": "/",
    "SESSION_SAME_SITE": "lax"
  },
  "urls": {
    "preview": "https://portal-investidor.test/management/opportunity-resources-install/organization-country",
    "profile": "https://portal-investidor.test/investidor/profile",
    "logout": "POST https://portal-investidor.test/logout"
  },
  "steps": [
    "Verify exact final package, certificate SAN/chain/validity/private key permissions, all active baseline hashes and backup/restored clone <=24h",
    "Stage C110 application sources and reviewed production build with COUNTRY02 flag false; preserve previous sources and all immutable assets",
    "Only after explicit HTTPS authorization: validate Apache TLS proposal httpd -t, configure exact host and selected active certificate, effective .env/cache values, graceful reload; redirect GET/HEAD HTTP to HTTPS and reject HTTP credentials",
    "Use actual manager, verified email, normal MFA on HTTPS; check effective target5432 investemoz, code54 and preview hash, ONLY050000/two nullable columns/0tables/users/representations",
    "POST same server key/hash/body for retries; check one audit and one migration; no030/040/190",
    "Enable only COUNTRY02 and test legitimate organization/membership permissions, save/update/recover, encrypted Back/Forward and logout/new session"
  ],
  "stop_conditions": [
    "certificate trust/SAN/expiry/baseline/package/backup mismatch",
    "actual preview differs",
    "private history/session/authorization/asset/mixed-content failure",
    "missing explicit authorization for HTTPS and replacement delivery"
  ],
  "reversal": [
    "Disable COUNTRY02 first; keep050000, country values/provenance, ledger/audit and backups; never drop columns",
    "Restore preserved previous source/build manifest atomically without deleting immutable assets",
    "Revert only the specific Apache/env/cache changes from snapshots and validate/reload; change session cookie namespace to avoid reuse",
    "Preferred safe containment keeps HTTPS and flag disabled; a full HTTP reversion removes the HTTPS deliverable and reopens C111 for private pages; do not claim working private COUNTRY02 over HTTP",
    "No key:generate, MFA disable, table/account/representation changes, HSTS during initial rollout or other packages"
  ],
  "active_configuration_changed": false,
  "authorization_required": [
    "replacement final delivery",
    "HTTPS certificate/trust distribution + exact Apache/env change",
    "050000 authenticated action + COUNTRY02 flag only"
  ]
}