{"ok":true,"request_id":"req_fdpurp1zmsutdiyq","service":"cloak-harbor-ped","version":"v1","data":{"service":"cloak-harbor-ped","version":"0.10.0","environment":"production","status":"healthy","mode":"production","timestamp":"2026-08-15T20:14:00.770Z","checks":{"fixture_fallback":"available_for_unconfigured_storage_only","ai_gateway":"configured-server-side","api_key_gate":"enforced","database":"configured-postgres","blob_storage":"configured-server-side","aws_evidence_vault":"configured-server-side","wayback":"missing-env","twilio":"missing-env","capability_persistence":"configured","cache":"unsupported","mcp":"supported","trace":"lifecycle-export-configured"},"runtime":{"backendMode":"postgres","requestedBackendMode":"auto","databaseConfigured":true,"postgresSupported":true,"persistenceProvider":"aurora_postgres","isVercel":true,"vercelDegraded":false,"persistenceState":"configured","supportFlags":[{"id":"deterministic-fixtures","label":"Redacted public baseline","category":"data","uiState":"connected","dockerPostgres":true,"vercel":true,"proof":"A redacted case baseline keeps onboarding, exposure review, Kanban, cadence, and StealthScore surfaces available when no selected client is loaded.","degradedCopy":"Public-safe baseline only; saved client records replace it as soon as a real authorized case is selected.","externalActionTaken":false},{"id":"capability-catalog","label":"PED OS capability catalog","category":"ui","uiState":"connected","dockerPostgres":true,"vercel":true,"proof":"The JSON catalog feeds the landing page, API, MCP, LLMS, and tests.","degradedCopy":"Catalog remains readable even when persistence is unavailable.","externalActionTaken":false},{"id":"postgres-capability-support","label":"Postgres capability support flags","category":"data","uiState":"configured","dockerPostgres":true,"vercel":true,"configuredBy":"AWS Aurora POSTGRES_PG* variables, or DATABASE_URL for local Docker","proof":"Postgres-backed setup seeds cloak_capability_support and verifies durable support rows.","degradedCopy":"Vercel reports redacted/degraded mode until Aurora/Postgres is configured.","externalActionTaken":false},{"id":"local-audit-events","label":"Local audit event persistence","category":"workflow","uiState":"configured","dockerPostgres":true,"vercel":true,"configuredBy":"Aurora/Postgres connection","proof":"Postgres writes cloak_local_audit_events with external_action_taken=false.","degradedCopy":"Deployments without Aurora/Postgres show public-safe trace summaries and do not claim durable audit persistence.","externalActionTaken":false},{"id":"protected-capability-bootstrap","label":"Protected capability bootstrap API","category":"api","uiState":"protected_required","dockerPostgres":true,"vercel":true,"configuredBy":"server operator credential + Aurora/Postgres connection","proof":"POST /api/v1/setup and POST /api/v1/capabilities seed support rows only after platform-key authorization.","degradedCopy":"Without Postgres, the route returns postgres_not_configured instead of fake success.","externalActionTaken":false},{"id":"mcp-capability-introspection","label":"MCP capability introspection","category":"api","uiState":"connected","dockerPostgres":true,"vercel":true,"proof":"MCP capability introspection exposes the catalog and runtime mode.","degradedCopy":"MCP reports public-safe degraded runtime when Postgres is absent.","externalActionTaken":false},{"id":"external-service-actions","label":"External service actions","category":"integration","uiState":"scaffolded","dockerPostgres":false,"vercel":false,"proof":"Jitsi, Twilio, SendGrid, Cloudflare, AWS, SCC, scan, and submit tools all return implemented:false.","degradedCopy":"Every external action remains scaffolded/protected until intentionally wired.","externalActionTaken":false},{"id":"web-scan-execution","label":"Live web scan execution","category":"integration","uiState":"scaffolded","dockerPostgres":false,"vercel":false,"proof":"The planner can preview scope; it does not crawl, fetch, or run BrowserOps capture.","degradedCopy":"No live scan has been performed until an authorized client run is explicitly queued.","externalActionTaken":false},{"id":"message-delivery","label":"SMS/email delivery","category":"integration","uiState":"dry_run","dockerPostgres":false,"vercel":false,"proof":"Communications surfaces show templates and approval gates only.","degradedCopy":"No message has been sent and no delivered state is shown.","externalActionTaken":false},{"id":"provider-provisioning","label":"Provider provisioning","category":"integration","uiState":"protected_required","dockerPostgres":false,"vercel":false,"proof":"Cloudflare, AWS, SCC, and mail controls produce scaffold/protected responses only.","degradedCopy":"No resource has been provisioned.","externalActionTaken":false},{"id":"executive-report-publish","label":"Executive report publishing","category":"workflow","uiState":"ready_for_review","dockerPostgres":true,"vercel":true,"proof":"Reports generate, review, and record blocked Docs/Sheets/Files handoff intents in Postgres.","degradedCopy":"No report is published to Docs, Sheets, Files, or AWS until those integrations are configured.","externalActionTaken":false},{"id":"responsible-use-gates","label":"Responsible-use gates","category":"safety","uiState":"connected","dockerPostgres":true,"vercel":true,"proof":"Sensitive UI controls and MCP tools state human approval and externalActionTaken:false.","degradedCopy":"Safety gates remain active for public-safe fallback and authorized client cases.","externalActionTaken":false}],"supportSummary":{"total":12,"dockerPostgresSupported":8,"vercelSupported":8,"externalActionTaken":false},"serverCapabilities":[{"key":"platform-auth","name":"Operator authorization","category":"platform","purpose":"Server-side authorization for protected operator actions and integration handoffs.","requiredEnv":["PLATPHORM_API_KEY"],"configuredEnv":["PLATPHORM_API_KEY"],"missingEnv":[],"state":"configured","secretValuesExposed":false},{"key":"platform-handoffs","name":"Protected handoff switch","category":"platform","purpose":"Kill switch for protected Docs, Sheets, Files, BrowserOps, Sandbox, Trace, and Pentest handoffs.","requiredEnv":["PLATPHORM_API_KEY","CLOAK_ENABLE_PLATFORM_HANDOFFS"],"configuredEnv":["PLATPHORM_API_KEY","CLOAK_ENABLE_PLATFORM_HANDOFFS"],"missingEnv":[],"state":"configured","secretValuesExposed":false},{"key":"visibility-policy","name":"Cloak visibility policy","category":"platform","purpose":"Controls authorized case data visibility across public, private, and redacted Cloak surfaces without exposing platform secrets.","requiredEnv":["CLOAK_VISIBILITY_MODE"],"configuredEnv":["CLOAK_VISIBILITY_MODE"],"missingEnv":[],"state":"configured","secretValuesExposed":false},{"key":"public-media-capture","name":"Public media capture","category":"storage","purpose":"Allows public-photo candidate manifests and approved media references to be stored through Files or object storage.","requiredEnv":["CLOAK_PUBLIC_MEDIA_CAPTURE"],"configuredEnv":["CLOAK_PUBLIC_MEDIA_CAPTURE"],"missingEnv":[],"state":"configured","secretValuesExposed":false},{"key":"postgres","name":"Persistent case database","category":"persistence","purpose":"Durable client, evidence, findings, Kanban, report, workflow, and protected intent storage.","anyEnv":[{"label":"DATABASE_URL or POSTGRES_URL","anyOf":["DATABASE_URL","POSTGRES_URL","POSTGRES_PRISMA_URL"]}],"requiredEnv":["Aurora/Postgres connection"],"configuredEnv":["Aurora/Postgres connection"],"missingEnv":[],"state":"configured","secretValuesExposed":false},{"key":"aurora","name":"AWS Aurora storage","category":"persistence","purpose":"Shared AWS Aurora cluster access with service-private Cloak Harbor tables.","requiredEnv":["POSTGRES_PGHOST","POSTGRES_PGUSER","POSTGRES_PGDATABASE","POSTGRES_PGPASSWORD"],"configuredEnv":["POSTGRES_PGHOST","POSTGRES_PGUSER","POSTGRES_PGDATABASE","POSTGRES_PGPASSWORD"],"missingEnv":[],"state":"configured","secretValuesExposed":false},{"key":"vercel-blob","name":"Vercel Blob evidence storage","category":"storage","purpose":"Server-side private artifact storage for OSINT run packets, reports, screenshots, exports, and redacted bundles.","requiredEnv":["BLOB_READ_WRITE_TOKEN"],"configuredEnv":["BLOB_READ_WRITE_TOKEN"],"missingEnv":[],"state":"configured","secretValuesExposed":false},{"key":"vercel-sandbox","name":"Vercel Sandbox diagnostics","category":"platform","purpose":"Optional isolated diagnostics for OSINT run packets without exposing secrets to untrusted code.","requiredEnv":["CLOAK_ENABLE_VERCEL_SANDBOX"],"configuredEnv":["CLOAK_ENABLE_VERCEL_SANDBOX"],"missingEnv":[],"state":"configured","secretValuesExposed":false},{"key":"webhook-delivery","name":"Signed webhook delivery","category":"platform","purpose":"Protected case lifecycle event emission with HMAC signing and Postgres delivery ledger.","requiredEnv":["PLATPHORM_WEBHOOK_SECRET","CLOAK_WEBHOOK_TARGET_URL"],"configuredEnv":[],"missingEnv":["PLATPHORM_WEBHOOK_SECRET","CLOAK_WEBHOOK_TARGET_URL"],"state":"missing-env","secretValuesExposed":false},{"key":"aws-evidence-vault","name":"AWS evidence vault credentials","category":"storage","purpose":"Server-side object storage credential set for evidence vault operations.","requiredEnv":["AWS_ACCESS_ID","AWS_ACCESS_SECRET"],"configuredEnv":["AWS_ACCESS_ID","AWS_ACCESS_SECRET"],"missingEnv":[],"state":"configured","secretValuesExposed":false},{"key":"ai-gateway","name":"Drafting gateway","category":"platform","purpose":"Redacted case guidance and draft generation through Vercel-managed provider routing.","anyEnv":[{"label":"AI_GATEWAY_API_KEY or VERCEL_OIDC_TOKEN","anyOf":["AI_GATEWAY_API_KEY","VERCEL_OIDC_TOKEN"]}],"requiredEnv":["AI_GATEWAY_API_KEY or VERCEL_OIDC_TOKEN"],"configuredEnv":["AI_GATEWAY_API_KEY"],"missingEnv":[],"state":"configured","secretValuesExposed":false},{"key":"ai-provider-fallbacks","name":"Direct drafting provider fallbacks","category":"platform","purpose":"Server-side fallback credentials for provider-specific workflows when Gateway is unavailable.","anyEnv":[{"label":"OPENAI_API_KEY or ANTHROPIC_API_KEY or GROK_API_KEY","anyOf":["OPENAI_API_KEY","ANTHROPIC_API_KEY","GROK_API_KEY"]}],"requiredEnv":["OPENAI_API_KEY or ANTHROPIC_API_KEY or GROK_API_KEY"],"configuredEnv":[],"missingEnv":["OPENAI_API_KEY or ANTHROPIC_API_KEY or GROK_API_KEY"],"state":"missing-env","secretValuesExposed":false},{"key":"wayback","name":"Wayback source evidence","category":"discovery","purpose":"Authorized public archive checks and historical source evidence collection.","requiredEnv":["WAYBACK_API_KEY"],"configuredEnv":[],"missingEnv":["WAYBACK_API_KEY"],"state":"missing-env","secretValuesExposed":false},{"key":"twilio","name":"Twilio secure communications","category":"communications","purpose":"Approved client notifications and phone verification workflows from server-side routes.","requiredEnv":["TWILIO_API_KEY"],"configuredEnv":[],"missingEnv":["TWILIO_API_KEY"],"state":"missing-env","secretValuesExposed":false},{"key":"numverify","name":"Numverify phone validation","category":"discovery","purpose":"Server-side validation of authorized onboarding phone identifiers, with visibility-policy evidence and task workflow output.","requiredEnv":["NUMVERIFY_API_KEY"],"configuredEnv":["NUMVERIFY_API_KEY"],"missingEnv":[],"state":"configured","secretValuesExposed":false},{"key":"recovery-answer-review","name":"Recovery-answer exposure review","category":"discovery","purpose":"Defensive source-link workflow for human review of password-recovery clue exposure without storing actual answer values. The drafting gateway is used only when available; deterministic fallback remains supported.","requiredEnv":[],"configuredEnv":[],"missingEnv":[],"state":"configured","secretValuesExposed":false}],"serverCapabilitySummary":{"total":16,"configured":12,"missingEnv":4,"secretValuesExposed":false},"visibilityPolicy":{"mode":"public","publicCaseData":true,"protectedCaseData":true,"redactedCaseData":false,"publicMediaCapture":true,"secretValuesExposed":false},"externalActionTaken":false,"explanation":"AWS Aurora PostgreSQL persistence is configured for Cloak Harbor-owned state, audit ledgers, and protected operator workflows."},"serverCapabilitySummary":{"total":16,"configured":12,"missingEnv":4,"secretValuesExposed":false},"counts":{"fallbackFindings":12,"integrations":44,"planned_or_degraded":9},"routeComplianceScore":1,"discoveryStatus":{"llms":"supported","openapi":"supported","sitemap":"supported","sitemapIndex":"supported","rss":"supported","feed":"supported","atom":"supported","robots":"supported","wellKnown":"supported","mcp":"supported","publicPrivateBoundary":"protected writes require PLATPHORM_API_KEY"},"rssStatus":"supported","sitemapStatus":"supported","llmsStatus":"supported","openapiStatus":"supported","trustedDomainStatus":"trusted-platphormnews-domain","traceEnabled":true,"traceExportEnabled":true,"traceStatus":"configured","traceContextAccepted":true,"traceContextPropagated":true,"traceObservability":{"lifecycle":"supported","evidence":"supported","productOperations":["report-handoff","mcp-tool-call","platform-handoff"],"exporter":"configured"},"redactionStatus":"raw secrets, IPs, cookies, bodies and x-vercel-ja4-digest are not exposed publicly","vercelMetadataCaptured":true,"vercelMetadataStatus":"safe allowlisted request metadata is captured when Vercel supplies it; secrets and raw IPs are excluded"}}