{
  "schema_version": "contextra.field-diagnosis.v1",
  "observed_date_kst": "2026-09-30",
  "lifecycle": "temporary",
  "scope": "Read-only current test AI certificate/mount/environment and Web101 configuration/DB comparison; no runtime start or HTTP requests",
  "test_ai": {
    "five_contextra_containers_running": false,
    "server_id": "AI-01",
    "manager": "https://<SITE_IP>",
    "prepared_connection_version": 1,
    "advertised_ip": "<SITE_IP>",
    "gateway_tls_host_mount": "/workspace/contextra-runtime-config/secure-bridge-tls",
    "gateway_tls_container_mount": "/run/ai-tls",
    "gateway_certificate_config": "/run/ai-tls/control-tls.crt",
    "sidecar_certificate_config": "/run/bridge/control-tls.crt",
    "certificate_subject": "CN=ai-control-<SITE_IP>",
    "certificate_san_ip": "<SITE_IP>",
    "certificate_valid_from_utc": "2026-09-18T04:02:14Z",
    "certificate_valid_to_utc": "2027-09-18T04:07:14Z",
    "gateway_and_sidecar_leaf_chain_and_ip_verify": "PASS",
    "manager_ca_file_sha256": "59baabe4c577f8d84e505f97bdf9e2313162485dd48012af15d27fdb92ebf324"
  },
  "web101": {
    "application_pid": 1795455,
    "ca_path_environment_values": {},
    "ca_path_launch_arguments": [],
    "ca_path_dotenv_values": {},
    "manager_ca_file_sha256": "59baabe4c577f8d84e505f97bdf9e2313162485dd48012af15d27fdb92ebf324",
    "current_database_server_id": "AI-01",
    "current_database_connection_version": 2,
    "current_database_advertised_ip": "<SITE_IP>",
    "current_database_redis_host": "<SITE_IP>"
  },
  "conclusions": [
    "Test AI has a usable existing leaf certificate mounted into Gateway; this is no longer merely an unverified possibility",
    "Test AI and Web101 use exactly the same CA file by SHA256; existing test leaves validate against that CA for the test IP",
    "Web101 missing signing paths remains consistent with the previous actual CERTIFICATE_SIGNING_NOT_CONFIGURED response",
    "Existing TLS certificate use does not require new certificate issuance, so prior test operation and current new-issuance failure are compatible",
    "Original September18 issuance method and Web configuration change history were not re-investigated",
    "No new enrollment from test was performed; current AI-01 registration now refers to ICERTI, so test must remain stopped pending deliberate restoration"
  ],
  "mutations": {"web_or_ai_config": 0, "db_writes": 0, "new_logins": 0, "http_requests": 0, "service_actions": 0}
}