{
  "artifact_id": "source-grounded-proof-api-route-protection-readiness-v01",
  "issue": 182,
  "upstream_decision_issue": 188,
  "date": "2026-06-30",
  "baseline_commit": "04782b6a1df846cf85a167dbfe4cc332337bffc3",
  "posture": {
    "recommended": "hybrid",
    "public_package_surfaces_remain_public": true,
    "proof_and_api_routes_are_protected": true,
    "future_private_lanes_protected_by_default": true,
    "whole_site_private_now": false
  },
  "route_inventory": [
    {
      "route": "https://ghostmesh.ai/",
      "posture": "public",
      "validation_expectation": "unauthenticated successful public load"
    },
    {
      "route": "https://www.ghostmesh.ai/",
      "posture": "redirect_to_apex",
      "validation_expectation": "redirects to https://ghostmesh.ai/"
    },
    {
      "route": "https://ghostmesh.ai/html/*",
      "posture": "public",
      "validation_expectation": "approved artifact pages load unauthenticated"
    },
    {
      "route": "https://ghostmesh.ai/downloads/*",
      "posture": "public",
      "validation_expectation": "approved downloads remain reachable unauthenticated"
    },
    {
      "route": "https://ghostmesh.ai/context-pack/*",
      "posture": "public_while_approved_package_material_only",
      "validation_expectation": "context-pack mirrors load and hashes validate"
    },
    {
      "route": "https://ghostmesh.ai/artifact-manifest.json",
      "posture": "public",
      "validation_expectation": "manifest loads unauthenticated"
    },
    {
      "route": "https://ghostmesh.ai/source-grounded-chat-proof*",
      "posture": "protected",
      "validation_expectation": "unauthenticated request requires Access or equivalent protection"
    },
    {
      "route": "https://ghostmesh.ai/source-grounded-chat-proof-runbook.md",
      "posture": "protected_in_production_contract_mode",
      "validation_expectation": "unauthenticated request requires Access or equivalent protection"
    },
    {
      "route": "https://ghostmesh.ai/api/source-grounded-chat*",
      "posture": "protected",
      "validation_expectation": "unauthenticated request requires Access, controlled denial, or method-limited response with no provider execution"
    },
    {
      "route": "Cloudflare preview aliases with provider-backed smoke",
      "posture": "protected_or_explicitly_allowlisted",
      "validation_expectation": "provider-backed smoke uses approved protected or allowlisted origin"
    },
    {
      "route": "Immutable Cloudflare deploy URLs with provider-backed smoke",
      "posture": "protected_or_unapproved_for_provider_backed_smoke",
      "validation_expectation": "no provider-backed smoke unless explicitly protected and allowlisted"
    },
    {
      "route": "GitHub Pages fallback or historical mirrors",
      "posture": "public_fallback_only",
      "validation_expectation": "does not bypass protected proof/API behavior"
    }
  ],
  "protected_route_set": [
    "https://ghostmesh.ai/source-grounded-chat-proof*",
    "https://ghostmesh.ai/source-grounded-chat-proof-runbook.md",
    "https://ghostmesh.ai/api/source-grounded-chat*"
  ],
  "public_surfaces": [
    "public landing page",
    "approved published artifact pages",
    "approved public downloads and portable HTML exports",
    "artifact manifest and hash evidence",
    "public context-pack mirrors while approved package material only",
    "public-safe architecture notes and receipts"
  ],
  "protected_surfaces": [
    "source-grounded proof page",
    "source-grounded proof runbook in production contract mode",
    "provider-backed API route",
    "provider-backed preview aliases used for smoke",
    "immutable deploy URLs used for provider-backed smoke",
    "future private artifacts",
    "future company-specific content",
    "future uploaded/session-source workflows",
    "future external/current context lanes with provider-backed or less-public inputs"
  ],
  "access_policy_shape": {
    "allowed_identities": [
      "tony@crysco.com",
      "malott@gmail.com"
    ],
    "trusted_reviewers": "only when explicitly named by the owner",
    "default_result": "deny everyone else",
    "client_side_only_gate_allowed": false,
    "shared_password_in_static_assets_allowed": false
  },
  "rate_limit_shape": {
    "host": "ghostmesh.ai",
    "method": "POST",
    "path": "/api/source-grounded-chat*",
    "action": "block",
    "requests_per_period": 5,
    "period_seconds": 10,
    "mitigation_timeout_seconds": 10,
    "counting_characteristics": [
      "cf.colo.id",
      "ip.src"
    ]
  },
  "boundary": {
    "no_whole_site_private_change": true,
    "no_company_specific_content": true,
    "no_uploaded_or_session_source_behavior": true,
    "no_external_or_current_context_mode": true,
    "no_provider_or_model_configuration_change": true,
    "no_grounding_or_refusal_weakening": true,
    "no_model_answers_without_approved_refs": true,
    "no_provider_secret_exposure": true,
    "no_client_side_only_password_protection": true,
    "no_shared_passwords_in_javascript_or_html": true,
    "no_external_vector_db_supabase_hosted_retrieval_or_knowledge_graph": true,
    "no_cloudflare_pages_exit": true,
    "github_remains_source_of_truth": true,
    "no_issue_relabeling": true,
    "no_269_or_271_reopen": true,
    "no_codex_automerge": true
  },
  "validation_commands": [
    "python3 -B scripts/build_context_pack.py",
    "python3 -B validation/scripts/check_source_grounded_proof_api_route_protection_readiness.py",
    "python3 -B validation/scripts/check_context_pack.py",
    "python3 -B validation/scripts/check_minimal_external_chat_proof.py",
    "python3 -B validation/scripts/check_published_site_contract.py",
    "python3 -B validation/scripts/run_all.py",
    "git diff --check"
  ]
}