{
  "version": 1,
  "scope": "Small Linux server administered over SSH; platform-specific commands require independent verification. Keep every control untested until executed on the target OS and preserve the actual outcome, including failures.",
  "controls": [
    {"id":"SEC-01","goal":"Named non-root administrator with working sudo and a recovery console","acceptance":"A fresh login as the named administrator succeeds, required sudo works, and the recovery console/path is identified and tested."},
    {"id":"SEC-02","goal":"Encrypted Ed25519 client key and verified server identity","acceptance":"A passphrase-protected Ed25519 private key remains on the client; only its public key is installed. Verify the server host-key fingerprint through an independent trusted path. Check authorized_keys ownership and permissions."},
    {"id":"SEC-03","goal":"Key-only SSH without direct root login","acceptance":"A new correct-key SSH login succeeds. Wrong-key, password-authentication and direct-root attempts are rejected. Check effective SSH configuration for the tested user/address and repeat after reboot."},
    {"id":"SEC-04","goal":"Default-deny inbound firewall with necessary administrative access","acceptance":"Add the management-source SSH allow rule before enabling default-deny inbound policy. Confirm a new SSH session still works. Start a harmless test service on an unallowed TCP port, prove it is listening locally and blocked remotely, then remove it and its temporary rule. Record IPv4/IPv6 and cloud firewall scope."},
    {"id":"SEC-05","goal":"Signed security updates and controlled reboot policy","acceptance":"Record signed repository/configuration and signature-verification state; record update refresh/check separately from actual package application, remaining updates, and reboot requirement. State automatic-update and automatic-reboot policy. A dry-run is not application. Execute and record a real package application; if no update is available, mark application not_run rather than accepted. Record post-reboot checks when a reboot is required."},
    {"id":"SEC-06","goal":"Service, authentication-log and time review","acceptance":"Record listening ports and enabled/running services, inspect authentication events (including the negative login attempts), and record explicit clock synchronization status and source/result."},
    {"id":"SEC-07","goal":"Recoverable configuration backup","acceptance":"Back up required configuration outside web/Git and verify access controls. Test restoring it from the recovery console, then repeat SSH authentication and effective-configuration checks."}
  ],
  "outcome_states": ["accepted", "expected_rejection", "failed", "not_run"],
  "evidence_requirements": "For each outcome retain dated command/output or observed behavior, exit status where applicable, OS/version and execution location. For screenshots retain the original capture, associated log, capture method/time, filename and SHA-256. Never fabricate or redraw evidence.",
  "excluded_from_minimum_profile": ["Changing the SSH port as a substitute for authentication","Blind disabling of services","Publishing private keys or reusable passwords","Claiming a container validates a full server firewall or boot"]
}