{
  "evidenceId": "T02",
  "title": "Portal / Kong release closeout",
  "originalRelativePath": "MR33_MIGRATION_WORK/mediflex/portal-overview/COMPLETION_MANIFEST.json",
  "originalSha256": "da6cb410ebd1803b6dd8936cd51390bbe662b2356eea179ed166c5d76b7ad259",
  "boundary": "Historical source evidence; selected fields; no new application execution or live configuration readback in this revision.",
  "record": {
    "status": "DEPLOYED_VERIFIED",
    "portalOrigin": "https://portal.kernelhealth.tech",
    "apiOrigin": "https://api.kernelhealth.tech",
    "edge": {
      "dns": "A record verified as 20.244.50.199",
      "tlsCertificate": "/etc/letsencrypt/live/portal.kernelhealth.tech/fullchain.pem",
      "route": "Portal Nginx TLS virtual host -> Kong -> existing HTTPS browser gateway",
      "apiCompatibility": "Existing API route remains. Only GET/HEAD requests for known UI entry points redirect from the API host to the portal; API endpoints are not redirected.",
      "browserApi": "Relative, same-origin browser API calls continue through Kong on the portal host. No cross-domain session cookies.",
      "authentication": "Portal is the canonical origin. Retain the registered API-host OIDC callback and logout return URL; relay callback to the fixed portal callback with state, nonce, PKCE and host-bound flow-cookie validation.",
      "configurationOwner": "Update only the web service public origin settings in /opt/kernel/current/services.private.json; its service runner overrides inherited environment settings."
    },
    "completedAt": "2026-10-11T08:27:58.676579+00:00",
    "release": "ebac600c88f5af301ec79fe02a547aea4251346f4b08b529475f6dba569c5433",
    "deployment": {
      "root": "OPS-REF-b823a184ae9f (resolve in operator source baseline)",
      "rollbackBackup": "/opt/kernel/backups/portal-overview-20261011T082749Z",
      "portalKongRouteId": "f7c02189-5a94-434a-8273-1d4917f44d39",
      "apiKongRouteChanged": false,
      "serviceOriginConfiguration": "web.env in /opt/kernel/current/services.private.json",
      "businessDatabaseChanged": false,
      "businessDataChanged": false,
      "grantsChanged": false,
      "gatewaySha256": "09eeb1d97ac0e213f3cfb0accc51187eefcd0f995e49deaf7f81bcb18f59c772",
      "mainIndexSha256": "594e796ebcf9b26535b00dfdb83afbbc0be4177080380a7419120665c7ad837a",
      "regulixIndexSha256": "bb4fc449f0603470a102ca821edb2b6ab94fd1ab1cdc964484bc137a64f405f4",
      "assetBundleChanged": false
    },
    "verification": {
      "unitAndProtocolTestsPassed": 27,
      "productionBrowserModules": [
        "Identity & access",
        "Axis",
        "Pulse",
        "Vista",
        "TimeVault",
        "Tenant Engine",
        "Tenant Control Plane",
        "Core",
        "Regulix"
      ],
      "draftAndNavigationChecks": "Preserved IAM account edits and Regulix process edits; retained filters, scroll, route and focus; existing leave guards remain active. Legacy overview URLs, responsive layouts and restricted menus verified.",
      "authorizedOverviewQueues": "Successful empty-page data loading verified in isolated fixtures; no unexpected API paths.",
      "liveChecks": {
        "portalLogin": 200,
        "hostBoundSecureCookie": true,
        "httpToHttps": true,
        "oldUiRedirect:/login": true,
        "oldUiRedirect:/mediflex-core?uiSource=mediflex-core&iam=users": true,
        "oldUiRedirect:/regulix/engine/design/bpmn": true,
        "https://portal.kernelhealth.tech/api/mediflex/tenant/custodia/repository/list": 401,
        "https://portal.kernelhealth.tech/api/mediflex/axis/mappings/owners": 401,
        "https://portal.kernelhealth.tech/api/mediflex/iam/timevault/query": 401,
        "https://portal.kernelhealth.tech/api/mediflex/iam/admin/access/query": 401,
        "https://portal.kernelhealth.tech untrustedOriginRejected": true,
        "https://api.kernelhealth.tech/api/mediflex/tenant/custodia/repository/list": 401,
        "https://api.kernelhealth.tech/api/mediflex/axis/mappings/owners": 401,
        "https://api.kernelhealth.tech/api/mediflex/iam/timevault/query": 401,
        "https://api.kernelhealth.tech/api/mediflex/iam/admin/access/query": 401,
        "https://api.kernelhealth.tech untrustedOriginRejected": true,
        "portalNativeFlowAccepted": true,
        "OPS-REF-6fa1528923fc (resolve in operator source baseline)": true,
        "portalSessionGate:/asset-static/index.html": true,
        "portalSessionGate:/regulix/": true,
        "ssoStartRetainsRegisteredCallback": true,
        "ssoRelayAndUnboundResponseRejection": true,
        "portalLoginClient": true
      },
      "nativeHealth": {
        "tenant": 200,
        "core": 200,
        "iam": 200,
        "axis": 200,
        "vista": 200,
        "process": 200
      },
      "publicBrowserChecks": [
        "Portal TLS and native sign-in form load with a secure host-bound flow cookie",
        "An old API-host User Accounts bookmark reaches portal sign-in with the intended screen retained",
        "Configured organization sign-in remains available on the portal"
      ],
      "realUserMfaOrSsoCompletionTested": false,
      "limitations": "Authorized UI flows were tested with isolated fixtures. Live verification covered TLS, the sign-in page, secure cookies, redirect and callback routing, authentication gates and service health; it did not sign in as a real user."
    },
    "rollback": "Back up edge configuration, Kong route, private service registry (server-local, mode 0600), gateway sources and active UI release; restore all on failed checks.",
    "verifiedBeforeActivation": {
      "sourceTypecheck": "PASS",
      "productionBuilds": [
        "MediFlex",
        "Regulix",
        "Asset (unchanged)"
      ],
      "unitAndProtocolTests": 27,
      "isolatedBrowserProofs": [
        "BROWSER_PROOF.json",
        "REGULIX_BROWSER_PROOF.json"
      ],
      "liveSourceBaseline": "938 existing compiled source files matched",
      "gatewayPatch": "Apply only the origin changes to the current deployed gateway; preserve environment-specific Regulix integrations",
      "initialActivation": "Automatically rolled back because the service registry retained the API origin. The new plan updates that authoritative configuration and verifies effective process origins before public checks.",
      "kongPropagation": "Observed a three-second delay before Kong proxy workers recognized a new host. Activation now waits for proxy-route readiness before exposing portal TLS."
    }
  },
  "readerProjection": "Kernel-scoped projection. Legacy infrastructure identifiers are opaque operator references; original source SHA256 is retained. No runtime identifier was renamed."
}