{
  "schema": "router-step-release-v1",
  "step_id": "STEP_050M07P28R2_R02_VM101_AWG_REMOTE_DNAT",
  "revision": "R02",
  "classification": "core",
  "step_class": "B",
  "workflow_contract_version": 2,
  "canonical_zip_required": true,
  "runtime_impact": true,
  "functional_stage": "awg_remote_vm101_public_udp_dnat",
  "touched_machines": [
    "VM101"
  ],
  "worker_entry": "scripts/worker.sh",
  "exact_worker_fixture": "tests/exact-worker.sh",
  "mandatory_fixture_count": 5,
  "target_package_path": "payload/vm101-awg-remote-dnat-target-package.tar.gz",
  "target_package_sha256": "536801c5c187fc2cbba14c90c2f44eb4fce10a800b4673682e9580b410b3c644",
  "expected_installer_sha256": "33b53fc1c5cf84f5d70286b2488dcf4d8d146652a9b38a270436becd4ca04296",
  "path_ownership_manifest": "reference/path-ownership.tsv",
  "target_environment_matrix": "reference/target-environment.tsv",
  "current_latest": "WG_PAID_MGTS_LATEST_20260915-073335.zip",
  "current_latest_sha256": "c762a5be2a1490c23c9136d8f9b883cc3e9f2571869efa8879d13f8b632a620e",
  "baseline_commit": "9b3eb4c7098e2d48372c013fa37b094e9e7798b7",
  "baseline_tree": "4cb7f1b72d854f3570935d208c76b99e2d4b039f",
  "baseline_file_count": 64,
  "baseline_file_sha256": {
    "etc/config/firewall": "955ee74a03e4dae4e944a713aa93723e203271b29c3053d2683d6cd71b87948e"
  },
  "accepted_preexisting_live_drift": {
    "path": "etc/config/firewall",
    "uci_section": "dnat_awg_paid_51831",
    "origin": "P28C accepted bounded manual mutation",
    "source_close_attribution": "preexisting accepted state, not created by P28R2"
  },
  "new_redirect": {
    "uci_section": "dnat_awg_remote_51832",
    "name": "DNAT-AWG-Remote-51832-to-VM100",
    "src": "wan",
    "src_dport": "51832",
    "dest": "Management",
    "dest_ip": "10.71.100.1",
    "dest_port": "51832",
    "proto": "udp",
    "target": "DNAT"
  },
  "source_of_truth": "current_latest_plus_vm101_machine_git_plus_live_semantic_preflight_plus_p28r1_vm100_accepted_runtime",
  "machine_git_change_required": true,
  "network_uci_intended_change": false,
  "firewall_uci_intended_change": true,
  "same_class_skeleton_gap": true,
  "same_class_skeleton_lookup_result": "no retained accepted VM101 firewall/DNAT STEP ZIP available; P26C4F absent and P28C was bounded manual experimental mutation; R01 STOPped preflight before mutation due VM100 witness SSH quoting defect",
  "canonicalization_intent": "on PASS this R02 becomes first pinned VM101 firewall/DNAT skeleton; R01 made no production mutation",
  "vm130_contract_commit": "fadde79bcc5756d478b8814f94ad16ad48fd25d2"
}