{
  "authorization_id": "nist-ssdf-current-source-runtime-prep-2026-06-25",
  "authorization_status": "authorized_for_pr_preparation_only",
  "authorization_scope": "Prepare an unmerged SSDF-only current/public runtime enablement PR. Production activation, merge, deployment, and external Cloudflare env/config mutation remain pending later explicit authorization.",
  "authorizer_name": "Tony",
  "authorizer_role": "package_governance_owner",
  "approval_reference": "Codex Ticket: Authorize and Prepare SSDF-Only Current/Public Runtime Enablement PR v01",
  "approval_timestamp": "not_recorded_for_external_config_activation",
  "source_id_authorized": "nist-ssdf-sp-800-218-candidate",
  "source_ids_authorized": [
    "nist-ssdf-sp-800-218-candidate"
  ],
  "source_name": "NIST Secure Software Development Framework SP 800-218 final v1.1",
  "source_class": "security_ai_safety_framework_source",
  "source_type": "secure_software_development_framework",
  "publisher": "NIST Computer Security Resource Center",
  "source_owner": "NIST Computer Security Resource Center",
  "canonical_url": "https://csrc.nist.gov/pubs/sp/800/218/final",
  "fetch_url": "https://csrc.nist.gov/pubs/sp/800/218/final",
  "allowed_origin": "https://csrc.nist.gov",
  "allowed_path_prefix": "/pubs/sp/800/218/final",
  "content_type": "text/html; charset=utf-8",
  "source_version_date": "SP 800-218 final, version 1.1, February 2022",
  "final_v1_1_binding": "Only NIST SP 800-218 final v1.1 at the canonical CSRC final publication page is authorized for this preparation PR.",
  "rev_1_draft_exclusion": "NIST SP 800-218 Rev. 1 Initial Public Draft is excluded from this preparation PR and from any later production scope unless separately authorized.",
  "publication_current_final_draft_status": "final v1.1 current target; Rev. 1 Initial Public Draft excluded from production scope",
  "public_fetchable_status": "HTTP 200 public HTML, zero redirects, no login observed on 2026-06-25",
  "license_public_use_notes": "Official NIST public publication page. Use only as current/public context and cite the NIST page.",
  "robots_rate_limit_notes": "CSRC robots probe redirected to CSRC home HTML in this environment. Use exact path only, no broad CSRC crawling, low-rate retrieval only.",
  "verifier": "Codex official-source probe",
  "verification_timestamp": "2026-06-25T13:32:28Z",
  "retrieval_readiness_status": "candidate_ready_for_owner_review_not_enabled",
  "production_enablement_status": "pending_later_merge_deploy_authorization",
  "package_authority_status": "not_package_authority",
  "claim_boundary": "current_public_secure_software_guidance_only_not_package_authority",
  "citation_label": "NIST SSDF current/public context",
  "runtime_adapter_to_preserve": "allowlisted_public_fetch",
  "runtime_env_or_config_variable_to_change": "AICD_CURRENT_CONTEXT_SOURCE_REGISTRY_JSON",
  "old_runtime_source_config_value": "external_cloudflare_value_not_stored_in_repo; current documented production baseline is NIST AI RMF only",
  "proposed_new_runtime_source_config_value": "external_cloudflare_value_not_stored_in_repo; proposed later change adds exactly nist-ssdf-sp-800-218-candidate to the existing NIST AI RMF production baseline and adds no other source",
  "proposed_runtime_source_registry_delta": {
    "operation": "add_single_source_after_later_external_authorization",
    "source_id": "nist-ssdf-sp-800-218-candidate",
    "url": "https://csrc.nist.gov/pubs/sp/800/218/final",
    "allowed_origin": "https://csrc.nist.gov",
    "allowed_path_prefix": "/pubs/sp/800/218/final",
    "source_type": "secure_software_development_framework",
    "trust_label": "owner_approved_authoritative",
    "freshness_label": "periodic_review_required",
    "claim_boundary": "current_public_secure_software_guidance_only_not_package_authority",
    "query_terms": [
      "ssdf",
      "secure software development framework",
      "sp 800-218"
    ]
  },
  "deployment_target": "preview_first_then_production_after_later_explicit_authorization",
  "preview_deployment_reference": "pending_later_preview_deployment",
  "production_deployment_reference": "pending_later_production_deployment",
  "smoke_owner": "Tony",
  "rollback_owner": "Tony",
  "post_change_verification_timestamp": "pending_later_external_config_smoke",
  "production_activation_status": "pending_later_merge_deploy_authorization",
  "external_cloudflare_config_change_status": "pending_later_explicit_authorization",
  "explicit_exclusions": [
    "NIST SP 800-218 Rev. 1 Initial Public Draft",
    "OWASP GenAI 2025 Top 10",
    "CISA / NSA / NCSC secure AI guidance",
    "regulated-life-sciences sources",
    "standards/paywalled sources",
    "broad CSRC crawling",
    "broad nist.gov or csrc.nist.gov crawling",
    "arbitrary web search",
    "user-provided URL retrieval",
    "browser-side current-source fetches",
    "browser-side provider calls"
  ],
  "authorization_scope_notes": "Authorized for SSDF-only enablement PR preparation. Not authorized for production activation until later merge and deploy approval. Not authorized for external Cloudflare env/config mutation in this task. Not authorized for any non-SSDF source.",
  "cloudflare_config_changed_in_this_pr": false,
  "production_activation_authorized_in_this_task": false,
  "external_cloudflare_config_mutation_authorized_in_this_task": false,
  "repo_candidate_registry_enablement_allowed": false,
  "package_authority_promotion_allowed": false,
  "owasp_enablement_allowed": false,
  "cisa_nsa_ncsc_enablement_allowed": false,
  "regulated_life_sciences_enablement_allowed": false,
  "standards_source_enablement_allowed": false,
  "broad_web_retrieval_allowed": false,
  "browser_side_current_source_fetches_allowed": false,
  "browser_side_provider_calls_allowed": false,
  "arbitrary_web_search_allowed": false,
  "user_provided_url_retrieval_allowed": false,
  "telemetry_database_vector_upload_session_attachment_allowed": false
}