{
  "schema_version": "contextra.field-diagnosis.v1",
  "observed_date_kst": "2026-09-30",
  "lifecycle": "temporary",
  "scope": "Web101 code/config/DB read-only and one explicitly authorized non-issuing invalid-CSR diagnostic request",
  "web_head": "9776f8e092283f1d5cf5f093aea2860882a328f6",
  "original_failure_time_kst": "2026-09-30T15:57:48+09:00",
  "web_connection_readback": {
    "server_id": "AI-01",
    "connection_config_version": 2,
    "advertised_ip": "<SITE_IP>",
    "control_port": 38443,
    "redis_host": "<SITE_IP>",
    "redis_port": 16379,
    "updated_at_wall_ms": 1790751467954
  },
  "ai_stage": {
    "path": "/workspace/contextra/data/site/field-20260930T155631-91276",
    "prepared_version": 2,
    "session_present": true,
    "leaf_present": false,
    "original_error": "CERTIFICATE_ENROLL_REJECTED",
    "original_phase": "CERTIFICATE",
    "original_http_status": 500
  },
  "diagnostic_request": {
    "endpoint_path": "/api/v1/ai-control/certificates",
    "method": "POST",
    "csr": "deliberately invalid text without public key; signing impossible under inspected source and compiled code",
    "existing_session_reused": true,
    "new_login_requests": 0,
    "request_count": 1,
    "http_status": 500,
    "remote_code": "INTERNAL_ERROR",
    "remote_reason": "CERTIFICATE_SIGNING_NOT_CONFIGURED",
    "session_file_unchanged": true,
    "issued_leaf_present_after": false
  },
  "confirmed_cause": {
    "server": "Web101",
    "description": "Signer disabled because manager CA certificate/key paths are not configured, independently of successful login connection registration",
    "property_names": ["platform.ai-control.manager-ca-cert-file", "platform.ai-control.manager-ca-key-file"],
    "environment_names": ["PLATFORM_MANAGER_CA_CERT_FILE", "PLATFORM_MANAGER_CA_KEY_FILE"],
    "environment_or_envfile_values_present": false,
    "code": "AiCertificateSigningService.enabled/issue at 95-110; compiled enabled and CERTIFICATE_SIGNING_NOT_CONFIGURED branch confirmed",
    "source_config": "src/main/resources/application.properties:39-40 and compiled resource agree; optional .env import at108"
  },
  "existing_material": {
    "certificate": "/mnt/workspace/mhj/projects/icerti_poc/config/tls/manager-ca.crt",
    "key": "/mnt/workspace/mhj/projects/icerti_poc/config/tls/manager-ca.key",
    "certificate_sha256": "59baabe4c577f8d84e505f97bdf9e2313162485dd48012af15d27fdb92ebf324",
    "matches_ai_profile_trusted_ca": true,
    "ca_true": true,
    "public_keys_match": true,
    "readable_as_web_user": true,
    "key_format_supported_pkcs8": true,
    "private_key_material_logged_or_copied": false
  },
  "conclusions": [
    "Greater version contract is confirmed by code and successful DB update; this500 does not contradict it",
    "Creating a new account cannot enable missing global signer configuration",
    "Current Web code already implements signing; set existing CA paths and restart actual Web application rather than first attempting a source patch",
    "Closed-site Web is not inspected; same remedy applies only if its signer configuration is missing",
    "ct safe_error currently drops error.details.reason; diagnostic UX gap is separate from signing failure"
  ],
  "boundaries": {
    "web_config_code_db_writes_by_assistant": 0,
    "service_restarts": 0,
    "certificate_issuances_by_assistant": 0,
    "new_real_enrollments": 0,
    "git_changes": 0
  },
  "next": "Preserve the stage/session/version2. Web owner applies CA path configuration and restarts app. Then explicitly retry the same stage once; do not cancel, increment, or change identity to bypass this error."
}