{
  "$comment": [
    "GOV-06 substantiation record for siax.repo.json's `operationalState`.",
    "",
    "WHY THIS FILE EXISTS: `operationalState` is a claim about the world, and",
    "scripts/siax-doctor.mjs cannot check the world from CI (no network, and a",
    "check that needs the internet is a check that goes red for the wrong",
    "reason). What the doctor CAN do offline is refuse to accept the claim",
    "unless it is backed by a dated, machine-readable probe result that agrees",
    "with it. That is this file. Setting operationalState to \"running\" while",
    "the probes below say 402/404 now fails `pnpm siax:doctor`.",
    "",
    "HOW TO REFRESH: `node scripts/siax-doctor.mjs --live --write-evidence`",
    "(opt-in, needs network). Or edit by hand from a real probe -- but the",
    "doctor cross-checks `ok` against `httpStatus`, so a hand-written",
    "`ok: true` next to a 402 is itself a failure."
  ],
  "control": "GOV-06",
  "operationalState": "running",
  "checkedAt": "2026-09-22T19:08:50Z",
  "method": "scripts/siax-doctor.mjs --live --write-evidence (fetch, 15000ms timeout)",
  "probes": [
    {
      "fqdn": "0pt.app",
      "env": "prod",
      "url": "https://0pt.app/api/health",
      "httpStatus": 200,
      "ok": true,
      "note": "server: unknown"
    },
    {
      "fqdn": "api.0pt.app",
      "env": "prod",
      "url": "https://api.0pt.app/api/health",
      "httpStatus": 200,
      "ok": true,
      "note": "server: unknown"
    }
  ],
  "securityHeadersObserved": {
    "content-security-policy": "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self' data:; connect-src 'self'; frame-src 'none'; frame-ancestors 'none'; form-action 'self'; base-uri 'self'; object-src 'none'",
    "strict-transport-security": "max-age=63072000; includeSubDomains; preload",
    "x-frame-options": "DENY",
    "x-content-type-options": "nosniff",
    "referrer-policy": "strict-origin-when-cross-origin"
  },
  "runtimeEvidence": {
    "$comment": "Runtime-state 2026-09-15 (inuti SIAX Cloud, ej publikt routat): Coolify-app 54 shxd6lepxuxfsjsp0ath3z1g pa server6; container healthy; /api/health {ok:true, db:ok}; /api/ready HTTP 200 {ready:true}; security headers (HSTS/XFO/CSP) observerade; egen Postgres (0pt-edge-postgres, uuid xh70k0qa0cyju840zsvsgoze, migrations 001-013 = 60 tabeller, icke-superuser-roll 0pt_app NOBYPASSRLS); backup-cron 03:15 motor + 03:05 edge-DB; 0pt.app-DNS-cutover kvar hos Simon."
  }
}