{
  "schema": "rune-domain-network-policy/1",
  "release": "v2026.08.15.19",
  "policy_version": "1.1.0-experimental",
  "authority": "first_party_local_experimental_policy_snapshot_for_drift_replay_only",
  "truth_boundary": "This successor snapshot exists only to exercise local policy-drift analysis. A changed allow/deny/reason/rule is not real-world authorization, domain control, legal authority, network status, or external affiliation.",
  "groups": [
    {
      "id": "RuneDomainNetwork",
      "members": [
        "ᛟ.com",
        "ᛜ.com",
        "ᛉ.com",
        "ᚲ.com",
        "ᚨ.com",
        "ᛚ.com"
      ],
      "membership_authority": "operator_supplied"
    },
    {
      "id": "OtherRunicDomains",
      "members": [
        "ᛌ.com",
        "ᛠ.com",
        "ᛄ.com"
      ],
      "membership_authority": "operator_supplied"
    }
  ],
  "namespaces": [
    {
      "domain": "ᛟ.com",
      "rune": "ᛟ",
      "codepoint": "U+16DF",
      "group": "RuneDomainNetwork",
      "namespace_id": "rdn.u16df",
      "membership_authority": "operator_supplied"
    },
    {
      "domain": "ᛜ.com",
      "rune": "ᛜ",
      "codepoint": "U+16DC",
      "group": "RuneDomainNetwork",
      "namespace_id": "rdn.u16dc",
      "membership_authority": "operator_supplied"
    },
    {
      "domain": "ᛉ.com",
      "rune": "ᛉ",
      "codepoint": "U+16C9",
      "group": "RuneDomainNetwork",
      "namespace_id": "rdn.u16c9",
      "membership_authority": "operator_supplied"
    },
    {
      "domain": "ᚲ.com",
      "rune": "ᚲ",
      "codepoint": "U+16B2",
      "group": "RuneDomainNetwork",
      "namespace_id": "rdn.u16b2",
      "membership_authority": "operator_supplied"
    },
    {
      "domain": "ᚨ.com",
      "rune": "ᚨ",
      "codepoint": "U+16A8",
      "group": "RuneDomainNetwork",
      "namespace_id": "rdn.u16a8",
      "membership_authority": "operator_supplied"
    },
    {
      "domain": "ᛚ.com",
      "rune": "ᛚ",
      "codepoint": "U+16DA",
      "group": "RuneDomainNetwork",
      "namespace_id": "rdn.u16da",
      "membership_authority": "operator_supplied"
    },
    {
      "domain": "ᛌ.com",
      "rune": "ᛌ",
      "codepoint": "U+16CC",
      "group": "OtherRunicDomains",
      "namespace_id": "other.u16cc",
      "membership_authority": "operator_supplied"
    },
    {
      "domain": "ᛠ.com",
      "rune": "ᛠ",
      "codepoint": "U+16E0",
      "group": "OtherRunicDomains",
      "namespace_id": "other.u16e0",
      "membership_authority": "operator_supplied"
    },
    {
      "domain": "ᛄ.com",
      "rune": "ᛄ",
      "codepoint": "U+16C4",
      "group": "OtherRunicDomains",
      "namespace_id": "other.u16c4",
      "membership_authority": "operator_supplied"
    }
  ],
  "session_requirements": {
    "required_state": "ACTIVE",
    "protocol_version": "1.0.0",
    "allowed_ontology_versions": [
      "1.1.0"
    ],
    "recognized_negotiated_flags": [
      "ack-required",
      "human-review",
      "idempotent"
    ]
  },
  "capability_sets": [
    {
      "id": "cap.base.control",
      "minimum_ontology_version": "1.0.0",
      "required_flags": [],
      "semantic_ids": [
        "identity",
        "query",
        "ack",
        "success",
        "fault",
        "constraint",
        "continuity"
      ]
    },
    {
      "id": "cap.protected.route",
      "minimum_ontology_version": "1.1.0",
      "required_flags": [
        "ack-required"
      ],
      "semantic_ids": [
        "route",
        "protect",
        "stream",
        "route.query.payload",
        "payload.protect.stream",
        "identity.protect.ack"
      ]
    },
    {
      "id": "cap.reviewed.proposal",
      "minimum_ontology_version": "1.1.0",
      "required_flags": [
        "human-review"
      ],
      "semantic_ids": [
        "proposal",
        "proposal.human-review"
      ]
    }
  ],
  "group_capabilities": {
    "RuneDomainNetwork": [
      "cap.base.control",
      "cap.protected.route",
      "cap.reviewed.proposal"
    ],
    "OtherRunicDomains": [
      "cap.base.control",
      "cap.reviewed.proposal"
    ]
  },
  "rules": [
    {
      "rule_id": "rule.policy-version.exact",
      "effect": "deny_on_mismatch",
      "condition": "request policy_version must equal policy policy_version"
    },
    {
      "rule_id": "rule.domain.known",
      "effect": "deny_on_unknown",
      "condition": "source and target domains must be declared"
    },
    {
      "rule_id": "rule.group.claim.exact",
      "effect": "deny_on_spoof",
      "condition": "claimed source/target group must equal declared group when supplied"
    },
    {
      "rule_id": "rule.session.active",
      "effect": "deny_unless",
      "condition": "session state must equal ACTIVE"
    },
    {
      "rule_id": "rule.session.protocol.exact",
      "effect": "deny_unless",
      "condition": "negotiated protocol version must equal 1.0.0"
    },
    {
      "rule_id": "rule.session.ontology.allowed",
      "effect": "deny_unless",
      "condition": "negotiated ontology version must be allowed and meet capability minimum"
    },
    {
      "rule_id": "rule.flags.no-escalation",
      "effect": "deny_on_escalation",
      "condition": "requested and rule-required flags must be subsets of negotiated flags"
    },
    {
      "rule_id": "rule.semantic.group-capability",
      "effect": "deny_unless",
      "condition": "semantic_id must occur in a capability set allowed to both endpoint groups"
    },
    {
      "rule_id": "rule.cross-group.default-deny",
      "effect": "deny",
      "condition": "cross-group transition must match an explicit bridge rule"
    },
    {
      "rule_id": "rule.same-group.allow",
      "effect": "allow",
      "condition": "after all prior gates, same-group transition is allowed"
    }
  ],
  "bridge_rules": [
    {
      "rule_id": "bridge.ear-to-othala.query.experimental-shadow",
      "source_domain": "ᛠ.com",
      "target_domain": "ᛟ.com",
      "semantic_ids": [
        "query"
      ],
      "required_flags": [
        "ack-required"
      ],
      "effect": "allow",
      "authority": "first_party_local_experimental_policy_fixture"
    },
    {
      "rule_id": "bridge.sigel-to-othala.query.experimental",
      "source_domain": "ᛌ.com",
      "target_domain": "ᛟ.com",
      "semantic_ids": [
        "query"
      ],
      "required_flags": [],
      "effect": "allow",
      "authority": "first_party_local_experimental_policy_fixture"
    },
    {
      "rule_id": "bridge.ear-to-othala.query",
      "source_domain": "ᛠ.com",
      "target_domain": "ᛟ.com",
      "semantic_ids": [
        "query"
      ],
      "required_flags": [
        "ack-required"
      ],
      "effect": "allow",
      "authority": "first_party_local_policy_fixture"
    },
    {
      "rule_id": "bridge.ear-to-othala.review",
      "source_domain": "ᛠ.com",
      "target_domain": "ᛟ.com",
      "semantic_ids": [
        "proposal.human-review"
      ],
      "required_flags": [
        "human-review"
      ],
      "effect": "allow",
      "authority": "first_party_local_policy_fixture"
    },
    {
      "rule_id": "bridge.othala-to-ear.ack",
      "source_domain": "ᛟ.com",
      "target_domain": "ᛠ.com",
      "semantic_ids": [
        "ack"
      ],
      "required_flags": [
        "ack-required"
      ],
      "effect": "allow",
      "authority": "first_party_local_policy_fixture"
    }
  ],
  "evaluation_order": [
    "rule.policy-version.exact",
    "rule.domain.known",
    "rule.group.claim.exact",
    "rule.session.active",
    "rule.session.protocol.exact",
    "rule.session.ontology.allowed",
    "rule.flags.no-escalation",
    "rule.semantic.group-capability",
    "explicit_bridge_rules",
    "rule.cross-group.default-deny",
    "rule.same-group.allow"
  ],
  "default_effect": "deny",
  "policy_digest_sha256": "4fc9fbed94e5e16112f306a53c321caa7e55be805dcf8a9d926f1525e2f752c0",
  "experimental_changes": [
    {
      "change_id": "exp-shadow-existing-bridge",
      "kind": "rule-precedence",
      "description": "Add a more specific experimental query bridge ahead of the predecessor bridge so an existing local allow keeps its decision but changes rule identity."
    },
    {
      "change_id": "exp-add-sigel-to-othala-query",
      "kind": "bounded-cross-group-bridge",
      "description": "Allow only the historical ᛌ.com to ᛟ.com query fixture so replay demonstrates an explicit changed decision."
    }
  ]
}