{
  "assessment": {
    "all_ok": false,
    "success_checks": {
      "agent_reconcile_logic_seen": true,
      "agent_service_unit_present": true,
      "backend_create_flow_seen": true,
      "backend_creates_provisioning_jobs": true,
      "event_trigger_design_selected": true,
      "manual_agent_start_used": false,
      "private_material_not_published": true,
      "readonly_inventory_completed": true,
      "reconcile_design_required": true,
      "selector_logic_seen": true
    }
  },
  "capability_matrix": {
    "agent_has_reconcile_logic": true,
    "agent_service_unit_present": true,
    "agent_timer_enabled": false,
    "backend_can_touch_host_bind_mount_likely": true,
    "backend_creates_provisioning_jobs": true,
    "backend_existing_host_systemctl_trigger_seen": false,
    "backend_existing_postgres_notify_seen": false,
    "backend_has_subscription_create_flow": true,
    "reconcile_service_unit_present": false,
    "reconcile_timer_unit_present": false,
    "selector_logic_seen": true
  },
  "changes": {
    "backend_changed": "NO",
    "manual_agent_start_used": "NO",
    "services_enabled": "NO",
    "services_started": "NO",
    "vm100_changed": "NO",
    "vm101_changed": "NO",
    "vm121_changed": "NO"
  },
  "design_options": {
    "A_backend_calls_host_systemctl_directly": {
      "description": "Backend directly runs systemctl start wg-access-agent.service after DB commit.",
      "reason": "Usually wrong from Docker container unless host systemd/socket is deliberately exposed; inventory did not confirm existing safe host-systemctl bridge.",
      "recommended": false
    },
    "B_backend_writes_trigger_file_host_systemd_path": {
      "description": "Backend touches a bind-mounted trigger file; host systemd.path starts wg-access-agent.service.",
      "reason": "Simple event trigger if backend has shared bind mount to /opt/wg-access or a dedicated trigger directory. Needs exact mount confirmation and code insertion after commit.",
      "recommended": true
    },
    "C_postgres_notify_host_listener": {
      "description": "DB trigger or backend issues NOTIFY; host watcher listens and starts agent.",
      "reason": "Clean event-driven model but more moving parts; good later if file trigger is unsuitable.",
      "recommended": false
    },
    "D_small_host_job_watcher_polling": {
      "description": "Host daemon polls pending jobs every few seconds and starts agent.",
      "reason": "Reliable fallback but reintroduces polling; acceptable as watchdog, not primary happy path.",
      "recommended": false
    },
    "E_enable_existing_agent_timer_as_primary": {
      "description": "Enable wg-access-agent.timer and let it poll jobs.",
      "reason": "Contradicts desired event-driven contract; useful only as temporary safety if no trigger exists.",
      "recommended": false
    },
    "F_reconcile_on_boot_plus_safety_timer": {
      "description": "Add explicit reconcile service/timer to restore VM100 runtime/selector from VM121 DB after reboot/drift.",
      "reason": "Needed because VM100 peers are runtime-only and UCI remains empty by design.",
      "recommended": true
    }
  },
  "mode": "READONLY_DESIGN",
  "publish": {
    "local_report": "http://127.0.0.1:8099/r/e94a0859747d7b96f29c7fdafc2d0351ba603bb0a7e9e5a4/20260709-095112_step042b_agent_event_trigger_reconcile_design_readonly/",
    "trycf_report": "https://helena-background-beam-harry.trycloudflare.com/r/e94a0859747d7b96f29c7fdafc2d0351ba603bb0a7e9e5a4/20260709-095112_step042b_agent_event_trigger_reconcile_design_readonly/"
  },
  "recommended_contract": {
    "agent_contract": [
      "wg-access-agent.service remains Type=oneshot.",
      "It processes pending jobs idempotently.",
      "It may be started by event trigger.",
      "Happy-path tests must not call systemctl start manually."
    ],
    "backend_create_contract": [
      "Create peer and provisioning_job inside DB transaction.",
      "Commit transaction.",
      "Emit trigger after commit only.",
      "Do not publish private material in logs/reports."
    ],
    "happy_path_manual_agent_start_allowed": false,
    "implementation_order": [
      "042C implement chosen event trigger.",
      "042D implement explicit reconcile service/timer.",
      "042E happy-path create without manual agent start.",
      "042F VM100 reboot/reconcile recovery test.",
      "043 harness boolean contract fixes."
    ],
    "primary_happy_path_trigger": "B_backend_writes_trigger_file_host_systemd_path",
    "reconcile_contract": [
      "Create explicit wg-access-reconcile.service.",
      "Run reconcile on VM121 boot after network/docker/backend readiness.",
      "Add low-frequency safety timer, e.g. 5 minutes, for drift/reboot recovery.",
      "Reconcile restores runtime wg_paid peers and selector from VM121 DB/desired state.",
      "VM100 UCI peer persistence remains absent."
    ],
    "test_contract": [
      "042C/042D tests must record agent_start_source.",
      "manual_agent_start_used=False required for happy path.",
      "If backend create does not trigger agent, test must STOP_AGENT_EVENT_TRIGGER_BROKEN.",
      "VM100 reboot test must verify runtime peers vanish or reset, then recover via reconcile without manual agent start."
    ]
  },
  "schema": "router-step-facts-v1",
  "step": "STEP_042B_AGENT_EVENT_TRIGGER_RECONCILE_DESIGN_READONLY"
}