{
  "schema": "futhorc-wire-format/1",
  "release": "v2026.08.15.15",
  "protocol_version": "1.0.0",
  "current_ontology_version": "1.1.0",
  "authority": "first_party_experimental_wire_contract",
  "truth_boundary": "Codec correctness, canonical serialization, duplicate detection, freshness checks, and SHA-256 payload integrity are local implementation properties only. They do not prove cryptographic authenticity, network anti-replay security, adversarial robustness, authorization, or payload truth.",
  "encoding": {
    "frame": "binary envelope",
    "magic_ascii": "FTH1",
    "prefix": "4-byte magic followed by uint32 big-endian canonical-header byte length",
    "header": "NFC UTF-8 canonical JSON: sorted keys, no insignificant whitespace",
    "payload": "opaque bytes immediately following the canonical header"
  },
  "header_fields": [
    {
      "name": "protocol_version",
      "type": "string",
      "required": true,
      "rule": "must equal 1.0.0"
    },
    {
      "name": "ontology_version",
      "type": "string",
      "required": true,
      "rule": "must name a checked-in supported ontology"
    },
    {
      "name": "message_id",
      "type": "string",
      "required": true,
      "rule": "32 lowercase hexadecimal characters"
    },
    {
      "name": "sender_namespace",
      "type": "string",
      "required": true,
      "rule": "ASCII [a-z0-9][a-z0-9._-]{0,63}"
    },
    {
      "name": "intent_sequence",
      "type": "string",
      "required": true,
      "rule": "NFC sequence must resolve exactly in the named ontology and may not be reserved"
    },
    {
      "name": "intent_ids",
      "type": "array[string]",
      "required": true,
      "rule": "must contain exactly the semantic_id resolved by intent_sequence"
    },
    {
      "name": "payload_digest",
      "type": "string",
      "required": true,
      "rule": "sha256:<64 lowercase hex>"
    },
    {
      "name": "payload_size",
      "type": "integer",
      "required": true,
      "rule": "must equal payload byte length"
    },
    {
      "name": "created_unix_ms",
      "type": "integer",
      "required": true,
      "rule": "non-negative Unix milliseconds"
    },
    {
      "name": "max_age_ms",
      "type": "integer",
      "required": true,
      "rule": "0..86400000"
    },
    {
      "name": "flags",
      "type": "array[string]",
      "required": true,
      "rule": "sorted unique subset of declared flags"
    }
  ],
  "flags": [
    "ack-required",
    "human-review",
    "idempotent"
  ],
  "bounds": {
    "max_frame_bytes": 65536,
    "max_header_bytes": 4096,
    "max_payload_bytes": 61440,
    "max_sender_namespace_bytes": 64,
    "max_intent_codepoints": 12,
    "max_age_ms": 86400000,
    "future_clock_skew_ms": 30000
  },
  "canonicalization": [
    "All header strings must already be NFC.",
    "Header JSON must decode under strict UTF-8 and re-encode byte-for-byte to the canonical representation.",
    "Flags are lexicographically sorted and unique.",
    "Unknown header fields are rejected.",
    "Payload digest and payload size are verified during decode."
  ],
  "replay_model": "Reference ReplayGuard rejects duplicate message IDs inside its in-memory freshness window and rejects stale/far-future timestamps. This is a test model, not a complete network anti-replay protocol.",
  "ontology_migration": "1.0.0 -> 1.1.0 is additive. Existing IDs, sequences, semantic IDs, and reserved states may not be silently reassigned."
}