{
  "ironRecord": {
    "launch_ready": false,
    "sole_control_plane": {
      "phase": "P0_RND",
      "host": "175.178.192.226",
      "port": 5200,
      "role": "唯一加密操盘大脑",
      "rule": "只有此 IP 可签发/吊销/改加密策略；其它机器写接口必须失效或只读"
    },
    "warnings": [
      {
        "level": "CRITICAL",
        "code": "IRON_LAUNCH_GATE_OPEN",
        "message": "铁记录：正式上线前必须完成「唯一控制面 175.178.192.226」。多产品必须一域一机，禁止一根密钥管全家。融资后上 HSM+零信任+离线根。未确认上线闸门前本警告不可永久关闭。"
      },
      {
        "level": "WARNING",
        "code": "IRON_CHECKLIST_INCOMPLETE",
        "message": "上线闸门未完成项：sole_ip_live, others_write_disabled, vpn_only_admin, license_hard, mfa_dual, backup_drill, blast_radius_plan, ceiling_budget"
      }
    ],
    "banner": {
      "show": true,
      "snoozed": false,
      "snooze_until": null,
      "text": "铁记录：正式上线前必须完成「唯一控制面 175.178.192.226」。多产品必须一域一机，禁止一根密钥管全家。融资后上 HSM+零信任+离线根。未确认上线闸门前本警告不可永久关闭。",
      "doc_path": "/docs/security/IRON-RECORD-CONTROL-PLANE.md",
      "record_path": "/IRON_RECORD.json"
    },
    "checklist_open": 8
  },
  "status": "ok",
  "service": "bilzat-modular",
  "mode": "self-contained",
  "strictAntiCopy": true,
  "authBackend": "mysql",
  "controlPlane": {
    "name": "BilzatControlBrain",
    "title": "控制大脑",
    "principle": "一大脑统管：商业加密 + 模块强制 + 开发者授权 + 银行级安全；业务面平行、工作不停。专线只锁控制面。",
    "mode": "colocated",
    "enforce": "soft",
    "allow_ips": [],
    "allow_count": 0,
    "dedicated_line_ready": false,
    "readiness": {
      "score": 67,
      "passed": 6,
      "total": 9,
      "ready_for_dedicated": false,
      "switch_ready": false,
      "checks": [
        {
          "id": "banks_unified",
          "ok": true,
          "label": "A/加密/模块/B/银行安全已收拢到控制大脑"
        },
        {
          "id": "strict_anti_copy",
          "ok": true,
          "label": "STRICT_ANTI_COPY 开启"
        },
        {
          "id": "license_hard",
          "ok": true,
          "label": "License 生产硬闸（现网）"
        },
        {
          "id": "allow_ips",
          "ok": false,
          "label": "已配置专线/VPN IP 或 CIDR 名单"
        },
        {
          "id": "mfa",
          "ok": false,
          "label": "管理端 MFA 强制策略已开"
        },
        {
          "id": "dedicated_env",
          "ok": false,
          "label": "独立机 env 模板可导出（需先有名单）"
        },
        {
          "id": "hard_safe",
          "ok": true,
          "label": "hard 模式安全（有名单才允许）"
        },
        {
          "id": "dual_strict",
          "ok": true,
          "label": "双人审批严格模式（高危写）"
        },
        {
          "id": "hybrid_ready",
          "ok": true,
          "label": "混合抗量子签能力已就绪（切严用 LICENSE_HYBRID_REQUIRED）"
        }
      ]
    },
    "source": {
      "mode": "env",
      "enforce": "env",
      "allow_ips": "default"
    },
    "policy_file": "/www/wwwroot/bilzat-modular/data/control-plane/policy.json",
    "updated_at": null,
    "updated_by": null,
    "note": "",
    "listen_note": "现阶段与 :5200 同机托管；名单配齐后可一键迁独立专线机",
    "banks": [
      {
        "id": "A",
        "name": "商业授权",
        "desc": "租户/项目/绑机 License · Session · 升级",
        "path": "/admin/commercial-auth"
      },
      {
        "id": "E",
        "name": "系统加密",
        "desc": "采集 · 签发 · 硬闸门 · 与 :3000 共享钥根",
        "path": "/admin/system-encryption"
      },
      {
        "id": "M",
        "name": "模块强制",
        "desc": "七模块 Session 闸门 ↔ 七积木",
        "path": "/admin/module-control"
      },
      {
        "id": "L",
        "name": "四层防复制",
        "desc": "指纹 / 验签 / 运行时 / 密封对照",
        "path": "/admin/anti-copy-layers"
      },
      {
        "id": "B",
        "name": "开发者授权",
        "desc": "App · API Key · scopes（平行盘）",
        "path": "/admin/developer-auth"
      },
      {
        "id": "S",
        "name": "银行级安全",
        "desc": "MFA · 白名单 · 审批 · 审计",
        "path": "/admin/bank-security"
      }
    ],
    "business_planes": [
      {
        "name": "整站业务",
        "url": "http://101.33.243.44:3000",
        "note": "业务面 · 不受控制专线策略影响"
      },
      {
        "name": "CRM 业务",
        "url": "http://101.33.243.44:5100",
        "note": "业务面 · 不受控制专线策略影响"
      },
      {
        "name": "控制大脑（当前）",
        "url": "http://101.33.243.44:5200/admin/control-brain",
        "note": "控制面 · 后期迁专线机"
      }
    ],
    "switch_steps": [
      "在本页保存专线/VPN CIDR（或办公堡垒机出口 IP）",
      "导出独立机环境变量，部署到新服务器单端口",
      "设置 CONTROL_PLANE_MODE=dedicated + ENFORCE=hard",
      "防火墙仅放行专线网段到该端口；公网勿暴露控制面",
      "业务面 :3000/:5100 保持原机，用户工作不中断"
    ],
    "roadmap": [
      "P0 同机功能全齐（当前）：专线策略 + 双人审批 + 审计链 + 混合签能力",
      "P1 配齐真实专线 CIDR，soft 演练「谁会被拦」",
      "P2 换独立服务器：pm2 start ecosystem.control-brain.dedicated.config.js → hard",
      "P3 业务面 :3000/:5100 不动；控制面仅专线；License 混合重签后开 HYBRID"
    ],
    "dedicated_env": "# === 控制大脑 · 独立专线机（功能已齐，换机只改名单后启动）===\nNODE_ENV=production\nPORT=5200\nHOST=0.0.0.0\nCONTROL_PLANE_MODE=dedicated\nCONTROL_PLANE_ENFORCE=hard\nCONTROL_PLANE_ALLOW_IPS=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16\nSTRICT_ANTI_COPY=true\nLICENSE_MODE=prod\nLICENSE_ENFORCE=hard\nADMIN_MFA_ENFORCE=true\nADMIN_SESSION_TTL_MINUTES=15\nDUAL_APPROVAL_STRICT=true\nLICENSE_HYBRID_REQUIRED=true\nLICENSE_OFFLINE_SIGN_ONLY=true\nLICENSE_CONTROL_ROOT=/www/wwwroot/sunali1.05/data/license-control\nMYSQL_ENV_FILE=/www/wwwroot/sunali1.05/.env\nMYSQL_PLATFORM_DATABASE=bilzat-modular\nMYSQL_COMMERCIAL_DATABASE=bilzat_commercial\nMYSQL_DEVELOPER_DATABASE=bilzat_developer\n\n# 业务面保持原机：:3000 整站 · :5100 CRM —— 不要迁到控制专线机\n# 切严前请确认 License 已混合重签，否则先 LICENSE_HYBRID_REQUIRED=false",
    "features_ready": {
      "private_line_policy": true,
      "dual_approval": true,
      "audit_hash_chain": true,
      "hybrid_pq_sign": true,
      "switch_only_env": true,
      "note": "现网保持 soft/colocated；换专线机只改 env/名单即可进 hard"
    }
  },
  "mfa": {
    "enforce": true,
    "front_enforce": false,
    "grace_until": "2026-08-15T11:31:05.422Z",
    "in_grace": false,
    "model": "unified_account_totp",
    "issuer": "BilzatModular",
    "bound_count": 3,
    "bound_users": [
      "konak",
      "mfa_verify_user",
      "admin"
    ],
    "store_path": "/www/wwwroot/bilzat-modular/data/security/admin-mfa.json",
    "hint": "统一 TOTP（BilzatModular）：已绑定账号需动态码"
  },
  "license": {
    "mode": "prod",
    "enforce": "hard",
    "ok": true,
    "status": "valid",
    "license_id": "lic_msofm6ne_a7603d"
  },
  "encryptionRoutes": {
    "whole_project": "http://101.33.243.44:3000/admin/system-encryption",
    "bilzat_crm": "http://101.33.243.44:5100/system-encryption",
    "bilzat_crm_bank": "http://101.33.243.44:5100/bank-security",
    "modular_a_disk": "http://101.33.243.44:5200/admin/system-encryption",
    "modular_module_gate": "http://101.33.243.44:5200/admin/module-control",
    "control_brain": "http://101.33.243.44:5200/admin/control-brain",
    "note": "控制大脑统管 A/模块/B/银行安全；整站:3000 与 CRM:5100 为业务面，工作流量与专线控制面分离"
  },
  "mysql": {
    "ready": true,
    "error": null,
    "config": {
      "host": "127.0.0.1",
      "port": 3306,
      "user": "gpu_gov",
      "database": "bilzat-modular"
    }
  },
  "databases": {
    "platform": {
      "ready": true,
      "error": null,
      "database": "bilzat-modular"
    },
    "commercial": {
      "ready": true,
      "error": null,
      "database": "bilzat_commercial"
    },
    "developer": {
      "ready": true,
      "error": null,
      "database": "bilzat_developer"
    }
  },
  "disks": {
    "A": {
      "name": "商业授权",
      "database": "bilzat_commercial"
    },
    "B": {
      "name": "开发者授权",
      "database": "bilzat_developer"
    },
    "platform": {
      "name": "管理登录",
      "database": "bilzat-modular"
    }
  },
  "port": 5200,
  "pages": [
    "dashboard",
    "microservice",
    "control-brain",
    "commercial-auth",
    "module-control",
    "developer-auth",
    "bank-security",
    "bank-dr",
    "system-encryption",
    "anti-copy-layers",
    "login"
  ],
  "waveOrder": [
    "D",
    "A",
    "F",
    "C",
    "B",
    "E",
    "P"
  ],
  "blocks": [
    {
      "id": "D",
      "locked": true,
      "module_id": "core-os"
    },
    {
      "id": "A",
      "locked": true,
      "module_id": "chat"
    },
    {
      "id": "F",
      "locked": true,
      "module_id": "hetero-schedule"
    },
    {
      "id": "C",
      "locked": true,
      "module_id": "digital-staff"
    },
    {
      "id": "B",
      "locked": true,
      "module_id": "robot-loop"
    },
    {
      "id": "E",
      "locked": true,
      "module_id": "core-chain"
    },
    {
      "id": "P",
      "locked": true,
      "module_id": "meta-clearing"
    }
  ],
  "sevenModules": [
    {
      "module_id": "core-os",
      "block": "D",
      "force_session": true
    },
    {
      "module_id": "chat",
      "block": "A",
      "force_session": true
    },
    {
      "module_id": "hetero-schedule",
      "block": "F",
      "force_session": true
    },
    {
      "module_id": "digital-staff",
      "block": "C",
      "force_session": true
    },
    {
      "module_id": "robot-loop",
      "block": "B",
      "force_session": true
    },
    {
      "module_id": "core-chain",
      "block": "E",
      "force_session": true
    },
    {
      "module_id": "meta-clearing",
      "block": "P",
      "force_session": true
    }
  ],
  "ts": "2026-10-09T10:51:08.093Z"
}