{
  "date": "2026-10-10",
  "block": "12.5.118",
  "deployment": {
    "date": "2026-10-10",
    "baseCommit": "9da5e55",
    "baseContext": "build-bound116",
    "context": "build-export118",
    "override": "backend/src/routes/ipsec.ts",
    "sourceSha256": "4060f956cf30e26db326248f5f6574c75ed29f8952aa2afa65f0b099bfadb825",
    "containers": {
      "backend": {
        "imageTag": "mmapp-test/backend:ux-export118",
        "imageId": "sha256:395f100600ec69ef27a539a3a2ebb074e59bb2e21072c6c58cb3b6ef6281e13b",
        "state": "running",
        "health": "healthy"
      },
      "frontend": {
        "imageTag": "mmapp-test/frontend:ux-bound116",
        "imageId": "sha256:d641b518fa35291e2c25dcabdef13b730c307a424d3b96bc9847df79022ead28",
        "state": "running",
        "health": null
      },
      "postgres": {
        "imageTag": "postgres:18-alpine",
        "imageId": "sha256:77f585114c32fbca283dc835b0596f4e52b51b4c6662d7810b2f4084f60a1873",
        "state": "running",
        "health": "healthy"
      }
    },
    "compiledSha256": "1ec5eab50eb8383644c9bb17f190b222c07ce3f7ebb6b98e4c8f81053e6e32be"
  },
  "sourceByteHashMatches": true,
  "compiledRouteByteHashMatches": true,
  "before": {
    "date": "2026-10-10",
    "block": "12.5.118",
    "name": "mm-ipsec118-1791643362094",
    "cn": "mm-ipsec118-1791643362094",
    "observations": [
      {
        "serverId": 1,
        "active": [
          {
            ".id": "*1",
            "id": "CN=mm-ipsec118-1791643362094",
            "state": "established",
            "dynamic-address": "198.18.118.250",
            "remote-address": "104.165.244.7",
            "uptime": "1s"
          }
        ],
        "catalog": [
          {
            "name": "CN=mm-ipsec118-1791643362094",
            "commonName": "CN=mm-ipsec118-1791643362094",
            "certName": "ipsec-user-mm-ipsec118-1791643362094-decoy",
            "online": false
          },
          {
            "name": "mm-ipsec118-1791643362094",
            "commonName": "mm-ipsec118-1791643362094",
            "certName": "ipsec-user-mm-ipsec118-1791643362094",
            "online": true,
            "activeAddress": "198.18.118.250"
          }
        ]
      },
      {
        "serverId": 2,
        "active": [
          {
            ".id": "*1",
            "id": "194.226.121.150",
            "state": "established",
            "remote-address": "194.226.121.150",
            "uptime": "1s"
          }
        ],
        "catalog": []
      }
    ],
    "cleanup": [
      {
        "serverId": 1,
        "/system/logging": true,
        "/ip/ipsec/identity": true,
        "/ip/ipsec/peer": true,
        "/ip/ipsec/policy": true,
        "/ip/ipsec/policy/group": true,
        "/ip/ipsec/mode-config": true,
        "/ip/ipsec/proposal": true,
        "/ip/ipsec/profile": true,
        "/certificate": true,
        "/file": true,
        "/ip/address": true,
        "/ip/route": true,
        "/ip/firewall/nat": true
      },
      {
        "serverId": 2,
        "/system/logging": true,
        "/ip/ipsec/identity": true,
        "/ip/ipsec/peer": true,
        "/ip/ipsec/policy": true,
        "/ip/ipsec/policy/group": true,
        "/ip/ipsec/mode-config": true,
        "/ip/ipsec/proposal": true,
        "/ip/ipsec/profile": true,
        "/certificate": true,
        "/file": true,
        "/ip/address": true,
        "/ip/route": true,
        "/ip/firewall/nat": true
      }
    ],
    "databaseWrites": false,
    "certificate": {
      "name": "ipsec-user-mm-ipsec118-1791643362094",
      "common-name": "mm-ipsec118-1791643362094",
      "ca": "mm-ipsec118-1791643362094-ca",
      "key-usage": "digital-signature,key-encipherment,tls-client"
    },
    "certificates": [
      [
        {
          "name": "mm-ipsec118-1791643362094-ca",
          "trusted": "true",
          "trust-store": "all",
          "invalid-before": "2026-10-10 17:42:43",
          "invalid-after": "2026-10-12 17:42:43",
          "common-name": "mm-ipsec118-1791643362094-CA"
        },
        {
          "name": "mm-ipsec118-1791643362094-server",
          "trusted": "false",
          "trust-store": "all",
          "ca": "mm-ipsec118-1791643362094-ca",
          "invalid-before": "2026-10-10 17:42:44",
          "invalid-after": "2026-10-12 17:42:44",
          "common-name": "194.226.121.150"
        },
        {
          "name": "ipsec-user-mm-ipsec118-1791643362094",
          "trusted": "false",
          "trust-store": "all",
          "ca": "mm-ipsec118-1791643362094-ca",
          "invalid-before": "2026-10-10 17:42:44",
          "invalid-after": "2026-10-12 17:42:44",
          "common-name": "mm-ipsec118-1791643362094"
        },
        {
          "name": "ipsec-user-mm-ipsec118-1791643362094-decoy",
          "trusted": "false",
          "trust-store": "all",
          "ca": "mm-ipsec118-1791643362094-ca",
          "invalid-before": "2026-10-10 17:42:45",
          "invalid-after": "2026-10-12 17:42:45",
          "common-name": "CN=mm-ipsec118-1791643362094"
        }
      ],
      [
        {
          "name": "mm-ipsec118-1791643362094-client-imported",
          "trusted": "true",
          "trust-store": "ipsec",
          "invalid-before": "2026-10-10 16:42:44",
          "invalid-after": "2026-10-12 16:42:44",
          "common-name": "mm-ipsec118-1791643362094"
        },
        {
          "name": "mm-ipsec118-1791643362094-ca-imported",
          "trusted": "true",
          "trust-store": "ipsec",
          "invalid-before": "2026-10-10 16:42:43",
          "invalid-after": "2026-10-12 16:42:43",
          "common-name": "mm-ipsec118-1791643362094-CA"
        }
      ]
    ],
    "catalogCorrect": true,
    "dnPhase": {
      "active": [
        {
          ".id": "*1",
          "id": "CN=mm-ipsec118-1791643362094",
          "state": "established",
          "dynamic-address": "198.18.118.250",
          "remote-address": "104.165.244.7",
          "uptime": "1s"
        }
      ],
      "clients": [
        {
          "name": "CN=mm-ipsec118-1791643362094",
          "commonName": "CN=mm-ipsec118-1791643362094",
          "certName": "ipsec-user-mm-ipsec118-1791643362094-decoy",
          "online": false
        },
        {
          "name": "mm-ipsec118-1791643362094",
          "commonName": "mm-ipsec118-1791643362094",
          "certName": "ipsec-user-mm-ipsec118-1791643362094",
          "online": true,
          "activeAddress": "198.18.118.250"
        }
      ],
      "decoyOnline": false
    },
    "fqdnPhase": {
      "configuredRemoteId": "fqdn:mm-ipsec118-1791643362094.example",
      "nativeId": "mm-ipsec118-1791643362094.example",
      "assignedAddress": "198.18.118.250",
      "originalOnline": true,
      "decoyOnline": false
    },
    "export": {
      "status": 200,
      "identityAuth": "pre-shared-key",
      "remoteCertificateAbsent": true,
      "inferredCertificateName": "ipsec-user-mm-ipsec118-1791643362094-decoy",
      "archiveReturned": true,
      "archiveFilename": "cert_export_ipsec-user-mm-ipsec118-1791643362094-decoy.p12"
    },
    "certificateNativeIdPreserved": true
  },
  "native": {
    "date": "2026-10-10",
    "block": "12.5.118",
    "name": "mm-ipsec118-1791645331520",
    "cn": "mm-ipsec118-1791645331520",
    "observations": [
      {
        "serverId": 1,
        "active": [
          {
            ".id": "*1",
            "id": "CN=mm-ipsec118-1791645331520",
            "state": "established",
            "dynamic-address": "198.18.118.250",
            "remote-address": "104.165.244.7",
            "uptime": "1s"
          }
        ],
        "catalog": [
          {
            "name": "CN=mm-ipsec118-1791645331520",
            "commonName": "CN=mm-ipsec118-1791645331520",
            "certName": "ipsec-user-mm-ipsec118-1791645331520-decoy",
            "online": false
          },
          {
            "name": "mm-ipsec118-1791645331520",
            "commonName": "mm-ipsec118-1791645331520",
            "certName": "ipsec-user-mm-ipsec118-1791645331520",
            "online": true,
            "activeAddress": "198.18.118.250"
          }
        ]
      },
      {
        "serverId": 2,
        "active": [
          {
            ".id": "*1",
            "id": "194.226.121.150",
            "state": "established",
            "remote-address": "194.226.121.150",
            "uptime": "1s"
          }
        ],
        "catalog": []
      }
    ],
    "cleanup": [
      {
        "serverId": 1,
        "/system/logging": true,
        "/ip/ipsec/identity": true,
        "/ip/ipsec/peer": true,
        "/ip/ipsec/policy": true,
        "/ip/ipsec/policy/group": true,
        "/ip/ipsec/mode-config": true,
        "/ip/ipsec/proposal": true,
        "/ip/ipsec/profile": true,
        "/certificate": true,
        "/file": true,
        "/ip/address": true,
        "/ip/route": true,
        "/ip/firewall/nat": true
      },
      {
        "serverId": 2,
        "/system/logging": true,
        "/ip/ipsec/identity": true,
        "/ip/ipsec/peer": true,
        "/ip/ipsec/policy": true,
        "/ip/ipsec/policy/group": true,
        "/ip/ipsec/mode-config": true,
        "/ip/ipsec/proposal": true,
        "/ip/ipsec/profile": true,
        "/certificate": true,
        "/file": true,
        "/ip/address": true,
        "/ip/route": true,
        "/ip/firewall/nat": true
      }
    ],
    "databaseWrites": false,
    "certificate": {
      "name": "ipsec-user-mm-ipsec118-1791645331520",
      "common-name": "mm-ipsec118-1791645331520",
      "ca": "mm-ipsec118-1791645331520-ca",
      "key-usage": "digital-signature,key-encipherment,tls-client"
    },
    "certificates": [
      [
        {
          "name": "mm-ipsec118-1791645331520-ca",
          "trusted": "true",
          "trust-store": "all",
          "invalid-before": "2026-10-10 18:15:33",
          "invalid-after": "2026-10-12 18:15:33",
          "common-name": "mm-ipsec118-1791645331520-CA"
        },
        {
          "name": "mm-ipsec118-1791645331520-server",
          "trusted": "false",
          "trust-store": "all",
          "ca": "mm-ipsec118-1791645331520-ca",
          "invalid-before": "2026-10-10 18:15:34",
          "invalid-after": "2026-10-12 18:15:34",
          "common-name": "194.226.121.150"
        },
        {
          "name": "ipsec-user-mm-ipsec118-1791645331520",
          "trusted": "false",
          "trust-store": "all",
          "ca": "mm-ipsec118-1791645331520-ca",
          "invalid-before": "2026-10-10 18:15:35",
          "invalid-after": "2026-10-12 18:15:35",
          "common-name": "mm-ipsec118-1791645331520"
        },
        {
          "name": "ipsec-user-mm-ipsec118-1791645331520-decoy",
          "trusted": "false",
          "trust-store": "all",
          "ca": "mm-ipsec118-1791645331520-ca",
          "invalid-before": "2026-10-10 18:15:39",
          "invalid-after": "2026-10-12 18:15:39",
          "common-name": "CN=mm-ipsec118-1791645331520"
        }
      ],
      [
        {
          "name": "mm-ipsec118-1791645331520-client-imported",
          "trusted": "true",
          "trust-store": "ipsec",
          "invalid-before": "2026-10-10 17:15:35",
          "invalid-after": "2026-10-12 17:15:35",
          "common-name": "mm-ipsec118-1791645331520"
        },
        {
          "name": "mm-ipsec118-1791645331520-ca-imported",
          "trusted": "true",
          "trust-store": "ipsec",
          "invalid-before": "2026-10-10 17:15:33",
          "invalid-after": "2026-10-12 17:15:33",
          "common-name": "mm-ipsec118-1791645331520-CA"
        }
      ]
    ],
    "catalogCorrect": true,
    "dnPhase": {
      "active": [
        {
          ".id": "*1",
          "id": "CN=mm-ipsec118-1791645331520",
          "state": "established",
          "dynamic-address": "198.18.118.250",
          "remote-address": "104.165.244.7",
          "uptime": "1s"
        }
      ],
      "clients": [
        {
          "name": "CN=mm-ipsec118-1791645331520",
          "commonName": "CN=mm-ipsec118-1791645331520",
          "certName": "ipsec-user-mm-ipsec118-1791645331520-decoy",
          "online": false
        },
        {
          "name": "mm-ipsec118-1791645331520",
          "commonName": "mm-ipsec118-1791645331520",
          "certName": "ipsec-user-mm-ipsec118-1791645331520",
          "online": true,
          "activeAddress": "198.18.118.250"
        }
      ],
      "decoyOnline": false
    },
    "fqdnPhase": {
      "configuredRemoteId": "fqdn:mm-ipsec118-1791645331520.example",
      "nativeId": "mm-ipsec118-1791645331520.example",
      "assignedAddress": "198.18.118.250",
      "originalOnline": true,
      "decoyOnline": false
    },
    "export": {
      "status": 409,
      "identityAuth": "pre-shared-key",
      "remoteCertificateAbsent": true,
      "inferredCertificateName": "ipsec-user-mm-ipsec118-1791645331520-decoy",
      "archiveReturned": false
    },
    "boundExport": {
      "status": 200,
      "displayLabelDifferentFromCertificateName": true,
      "explicitCertificateArchiveReturned": true
    },
    "certificateNativeIdPreserved": true
  },
  "local": {
    "profileScripts": 8,
    "stateChecks": 114,
    "backendBuildPassed": true,
    "eslintPassed": true,
    "initialPositiveMockFailure": "Mock missing getCertificates; completed fixture and reran accepted",
    "focusedHttpRerunPassed": true
  },
  "bounds": [
    "Legacy managed user export only; explicit certificate-by-name endpoint unchanged",
    "Archives/passphrases/instructions were inspected only in memory, never in report/Git",
    "Positive response/archive returned, no new client OS or crypto interoperability claim",
    "Frontend remains bound116; full UI regression117 historical, not rerun118",
    "Native certificate session stayed live; no new PSK established session"
  ]
}