{
  "id": "wizard-fortress-public-gate",
  "version": "1.0.0",
  "updated": "2026-09-24",
  "mode": "proposal_only",
  "auto_apply": false,
  "track_a_writes": false,
  "checks": [
    {"id": "DNS-01", "need": "Apex and www resolve through Cloudflare to this Pages project"},
    {"id": "DNS-02", "need": "OpenAI TXT records exist on @ and www as issued, DNS-only proxy"},
    {"id": "TLS-01", "need": "HTTPS 200 on /, /privacy/, /actions/openapi.yaml"},
    {"id": "HDR-01", "need": "HSTS, nosniff, DENY frames, CSP present on HTML"},
    {"id": "API-01", "need": "GET /api/health returns mode=proposal_only execute=disabled"},
    {"id": "API-02", "need": "POST /api/v1/proposal with task returns AWAITING_HUMAN_APPROVAL and digest"},
    {"id": "API-03", "need": "POST worker=openai or execute=true returns 403"},
    {"id": "API-04", "need": "GET/POST /api/v1/execute /approve /apply return 403 FOREVER_DENIED"},
    {"id": "GPT-01", "need": "Schema URL fetches as text/yaml or similar; servers.url is https://www.wizard-fortress.com"},
    {"id": "GPT-02", "need": "Privacy URL is live and names this Action"},
    {"id": "GPT-03", "need": "Builder profile website uses verified wizard-fortress.com"},
    {"id": "SEP-01", "need": "No tunnel, WorkerSupervisor, or ControlledExecutor reachable from this origin"},
    {"id": "SEP-02", "need": "cwclaffs-del/ara GitHub tree was not merged into this public gate"}
  ]
}