{
  "schema": "router-machine-model-profile-v3",
  "machine_id": "vm101",
  "description": "WG Paid MGTS OpenWrt edge VM101",
  "rootfs_prefix": "rootfs",
  "ssh": {
    "outer_alias": "pve-mgts",
    "outer_connect_timeout_seconds": 10,
    "inner_user": "root",
    "inner_host": "10.71.100.2",
    "inner_identity_file": "/root/.ssh/pve_to_openwrt_mgts_ed25519",
    "inner_connect_timeout_seconds": 10,
    "strict_host_key_checking": true
  },
  "include_roots": [
    "/usr/local/bin",
    "/usr/local/sbin",
    "/usr/local/lib",
    "/etc/config",
    "/etc/init.d",
    "/etc/cron.d",
    "/etc/crontabs",
    "/etc/hotplug.d",
    "/etc/profile.d",
    "/etc/uci-defaults",
    "/etc/sysctl.d",
    "/etc/nftables.d",
    "/www/cgi-bin",
    "/etc/rc.local",
    "/etc/firewall.user"
  ],
  "scan_exclude_prefixes": [
    "/root/hmn/backups",
    "/root/hmn/test-runs",
    "/root/hmn/logs",
    "/root/hmn/cache",
    "/root/hmn/tmp"
  ],
  "public_exclude_globs": [
    "*/.ssh/*",
    "*/.ssh/**",
    "*/dropbear/*",
    "*/dropbear/**",
    "*/ssl/private/*",
    "*/ssl/private/**",
    "*/wireguard/*",
    "*/wireguard/**",
    "*.key",
    "**/*.key",
    "*.pem",
    "**/*.pem",
    "*.p12",
    "**/*.p12",
    "*.pfx",
    "**/*.pfx",
    ".env",
    "**/.env",
    "*.env",
    "**/*.env",
    "*secret*",
    "**/*secret*",
    "*token*",
    "**/*token*",
    "*credential*",
    "**/*credential*",
    "authorized_keys",
    "**/authorized_keys",
    "known_hosts",
    "**/known_hosts"
  ],
  "public_sanitize_prefixes": [
    "/etc/config"
  ],
  "public_sanitize_all_text_assignments": true,
  "public_binary_policy": "metadata_only",
  "sensitive_key_regex": "(?i)(password|passwd|secret|token|api[_-]?key|private[_-]?key|access[_-]?code|credential)",
  "validation": {
    "required_paths": [
      "/root/hmn/hmn-refresh-pool-safe.sh",
      "/root/hmn/hmn-code-test.sh",
      "/usr/local/lib/router-egress-vm101-runtime.sh"
    ],
    "required_shell_syntax_paths": [
      "/root/hmn/hmn-refresh-pool-safe.sh",
      "/root/hmn/hmn-code-test.sh",
      "/usr/local/lib/router-egress-vm101-runtime.sh"
    ]
  },
  "profile_revision": "managed-selectors-v3-artifact-excludes",
  "include_globs": [
    "/root/hmn/hmn-*.sh"
  ],
  "declared_excluded_paths": [
    {
      "path": "/root/hmn/hmn.env",
      "reason": "private secret settings"
    },
    {
      "path": "/root/hmn/refill.log",
      "reason": "runtime log"
    },
    {
      "path": "/root/hmn/backups",
      "reason": "generated backups"
    },
    {
      "path": "/root/hmn/cache",
      "reason": "generated cache"
    },
    {
      "path": "/root/hmn/checkpoints",
      "reason": "generated recovery evidence"
    },
    {
      "path": "/root/hmn/configs",
      "reason": "downloaded dynamic AWG configurations"
    },
    {
      "path": "/root/hmn/logs",
      "reason": "runtime logs"
    },
    {
      "path": "/root/hmn/patch-backups",
      "reason": "generated patch backups"
    },
    {
      "path": "/root/hmn/reports",
      "reason": "generated reports"
    },
    {
      "path": "/root/hmn/runs",
      "reason": "runtime execution records"
    },
    {
      "path": "/root/hmn/state",
      "reason": "runtime state"
    },
    {
      "path": "/root/hmn/test-runs",
      "reason": "test evidence"
    }
  ],
  "scan_exclude_globs": [
    "*.before-*",
    "*.before_*",
    "*.core-step*",
    "*.bak",
    "*.bak.*",
    "*.orig",
    "*.rej",
    "*~",
    "*/.#*",
    "*.swp",
    "*.tmp",
    "*.tmp.*"
  ],
  "declared_excluded_globs": [
    {
      "glob": "*.before-*",
      "reason": "pre-change backup or evidence copy"
    },
    {
      "glob": "*.before_*",
      "reason": "pre-change backup or evidence copy"
    },
    {
      "glob": "*.core-step*",
      "reason": "STEP evidence copy"
    },
    {
      "glob": "*.bak",
      "reason": "backup file"
    },
    {
      "glob": "*.bak.*",
      "reason": "versioned backup file"
    },
    {
      "glob": "*.orig",
      "reason": "patch original file"
    },
    {
      "glob": "*.rej",
      "reason": "patch rejection file"
    },
    {
      "glob": "*~",
      "reason": "editor backup"
    },
    {
      "glob": "*/.#*",
      "reason": "editor lock file"
    },
    {
      "glob": "*.swp",
      "reason": "editor swap file"
    },
    {
      "glob": "*.tmp",
      "reason": "temporary file or directory"
    },
    {
      "glob": "*.tmp.*",
      "reason": "versioned temporary file or directory"
    }
  ]
}