{
  "schema": "concresca.root-deployment-contract.v027",
  "site_version": "0.28.0-wip",
  "target": {
    "origin": "https://concresca.com",
    "application_root_example": "apps/concresca",
    "startup_file": "passenger_wsgi.py",
    "entry_point": "application",
    "url_path": ""
  },
  "architecture": "one root Python WSGI application serving the Concresca public corpus and delegating protected MATM routes to one canonical runtime",
  "required_private_state": [
    "MySQL/MariaDB credentials",
    "credential pepper",
    "runtime data",
    "logs",
    "backups",
    "incident evidence"
  ],
  "private_state_location": "outside the public application tree",
  "required_environment_variables": [
    "CONCRESCA_CANONICAL_ORIGIN",
    "CONCRESCA_ENVIRONMENT",
    "CONCRESCA_ACTIVATION_STATE",
    "CONCRESCA_PUBLIC_PROFILE",
    "CONCRESCA_PUBLIC_PROFILE_ACKNOWLEDGED",
    "CONCRESCA_ALLOWED_HOSTS",
    "CONCRESCA_TRUST_PROXY_HEADERS",
    "CONCRESCA_TRUSTED_PROXIES",
    "CONCRESCA_MATM_ENABLED",
    "CONCRESCA_MATM_IMPORT",
    "CONCRESCA_MATM_EXPECTED_COMMIT",
    "CONCRESCA_MATM_EXPECTED_TREE",
    "CONCRESCA_MATM_VENDOR_ROOT",
    "CONCRESCA_REQUIRE_MYSQL",
    "CONCRESCA_REQUIRE_DOGFOOD_RECEIPT",
    "CONCRESCA_DOGFOOD_RECEIPT_PATH",
    "MEMORYENDPOINTS_STORE_BACKEND",
    "MEMORYENDPOINTS_MYSQL_CONFIG_PATH",
    "MEMORYENDPOINTS_CREDENTIAL_PEPPER",
    "MEMORYENDPOINTS_SITE_NAME",
    "MEMORYENDPOINTS_SITE_URL",
    "MEMORYENDPOINTS_CORS_ALLOWED_ORIGINS"
  ],
  "cutover_order": [
    "obtain and authenticate the pinned upstream MATM source",
    "assemble one root package and run all clean-extraction tests",
    "create a dedicated MySQL/MariaDB database and least-privilege application user",
    "place credentials and pepper outside the public tree",
    "initialize and verify the schema in a staging application",
    "capture a byte-exact backup and tested rollback package for the current live root",
    "register Passenger at concresca.com root",
    "upload the validated integrated package and restart Passenger",
    "verify public corpus, MATM routes, /api/version, database backend, security headers, and discovery files",
    "perform an attributable bounded dogfood workflow and verify write/readback/receipt/correction",
    "only then retire the prior live runtime"
  ],
  "hard_gates": [
    "exact MATM source archive and installed tree pass non-circular custody verification",
    "full nonzero upstream Python, JavaScript, and verification-command suites pass",
    "owner explicitly authorizes the identified staging or production scope",
    "dedicated MySQL/MariaDB schema, migrations, rollback, backup, restore, and parity pass",
    "twenty-step two-agent dogfood and rights-preserving redress trials pass",
    "real Passenger HTTP, multiprocess, private-permission, log-redaction, restart, cutover, and rollback evidence passes",
    "byte-exact live-root backup and human cutover authorization exist"
  ],
  "current_state": "NOT_AUTHORIZED_FOR_LIVE_CUTOVER",
  "activation_receipt_policy": "/data/activation-receipt-policy/",
  "passenger_staging_contract": "/data/passenger-staging-contract/",
  "required_receipts": [
    "source",
    "upstream_suite",
    "mysql",
    "owner_authorization",
    "dogfood",
    "redress",
    "passenger"
  ]
}