{
  "schema": "rune-domain-network-policy/1",
  "release": "v2026.08.16.12",
  "policy_version": "1.0.1",
  "authority": "operator_supplied_grouping_plus_first_party_local_policy_fixture",
  "truth_boundary": "A local allow/deny result is a deterministic simulation under this checked-in policy. It does not authenticate peers, prove domain control, grant real-world authorization, prove DNS status, or establish external affiliation.",
  "groups": [
    {
      "id": "RuneDomainNetwork",
      "members": [
        "ᛟ.com",
        "ᛜ.com",
        "ᛉ.com",
        "ᚲ.com",
        "ᚨ.com",
        "ᛚ.com"
      ],
      "membership_authority": "operator_supplied"
    },
    {
      "id": "OtherRunicDomains",
      "members": [
        "ᛌ.com",
        "ᛠ.com",
        "ᛄ.com",
        "ᚻ.com"
      ],
      "membership_authority": "operator_supplied"
    }
  ],
  "namespaces": [
    {
      "domain": "ᛟ.com",
      "rune": "ᛟ",
      "codepoint": "U+16DF",
      "group": "RuneDomainNetwork",
      "namespace_id": "rdn.u16df",
      "membership_authority": "operator_supplied"
    },
    {
      "domain": "ᛜ.com",
      "rune": "ᛜ",
      "codepoint": "U+16DC",
      "group": "RuneDomainNetwork",
      "namespace_id": "rdn.u16dc",
      "membership_authority": "operator_supplied"
    },
    {
      "domain": "ᛉ.com",
      "rune": "ᛉ",
      "codepoint": "U+16C9",
      "group": "RuneDomainNetwork",
      "namespace_id": "rdn.u16c9",
      "membership_authority": "operator_supplied"
    },
    {
      "domain": "ᚲ.com",
      "rune": "ᚲ",
      "codepoint": "U+16B2",
      "group": "RuneDomainNetwork",
      "namespace_id": "rdn.u16b2",
      "membership_authority": "operator_supplied"
    },
    {
      "domain": "ᚨ.com",
      "rune": "ᚨ",
      "codepoint": "U+16A8",
      "group": "RuneDomainNetwork",
      "namespace_id": "rdn.u16a8",
      "membership_authority": "operator_supplied"
    },
    {
      "domain": "ᛚ.com",
      "rune": "ᛚ",
      "codepoint": "U+16DA",
      "group": "RuneDomainNetwork",
      "namespace_id": "rdn.u16da",
      "membership_authority": "operator_supplied"
    },
    {
      "domain": "ᛌ.com",
      "rune": "ᛌ",
      "codepoint": "U+16CC",
      "group": "OtherRunicDomains",
      "namespace_id": "other.u16cc",
      "membership_authority": "operator_supplied"
    },
    {
      "domain": "ᛠ.com",
      "rune": "ᛠ",
      "codepoint": "U+16E0",
      "group": "OtherRunicDomains",
      "namespace_id": "other.u16e0",
      "membership_authority": "operator_supplied"
    },
    {
      "domain": "ᛄ.com",
      "rune": "ᛄ",
      "codepoint": "U+16C4",
      "group": "OtherRunicDomains",
      "namespace_id": "other.u16c4",
      "membership_authority": "operator_supplied"
    },
    {
      "domain": "ᚻ.com",
      "rune": "ᚻ",
      "codepoint": "U+16BB",
      "group": "OtherRunicDomains",
      "namespace_id": "other.u16bb",
      "membership_authority": "operator_supplied"
    }
  ],
  "session_requirements": {
    "required_state": "ACTIVE",
    "protocol_version": "1.0.0",
    "allowed_ontology_versions": [
      "1.1.0"
    ],
    "recognized_negotiated_flags": [
      "ack-required",
      "human-review",
      "idempotent"
    ]
  },
  "capability_sets": [
    {
      "id": "cap.base.control",
      "minimum_ontology_version": "1.0.0",
      "required_flags": [],
      "semantic_ids": [
        "identity",
        "query",
        "ack",
        "success",
        "fault",
        "constraint",
        "continuity"
      ]
    },
    {
      "id": "cap.protected.route",
      "minimum_ontology_version": "1.1.0",
      "required_flags": [
        "ack-required"
      ],
      "semantic_ids": [
        "route",
        "protect",
        "stream",
        "route.query.payload",
        "payload.protect.stream",
        "identity.protect.ack"
      ]
    },
    {
      "id": "cap.reviewed.proposal",
      "minimum_ontology_version": "1.1.0",
      "required_flags": [
        "human-review"
      ],
      "semantic_ids": [
        "proposal",
        "proposal.human-review"
      ]
    }
  ],
  "group_capabilities": {
    "RuneDomainNetwork": [
      "cap.base.control",
      "cap.protected.route",
      "cap.reviewed.proposal"
    ],
    "OtherRunicDomains": [
      "cap.base.control",
      "cap.reviewed.proposal"
    ]
  },
  "rules": [
    {
      "rule_id": "rule.policy-version.exact",
      "effect": "deny_on_mismatch",
      "condition": "request policy_version must equal policy policy_version"
    },
    {
      "rule_id": "rule.domain.known",
      "effect": "deny_on_unknown",
      "condition": "source and target domains must be declared"
    },
    {
      "rule_id": "rule.group.claim.exact",
      "effect": "deny_on_spoof",
      "condition": "claimed source/target group must equal declared group when supplied"
    },
    {
      "rule_id": "rule.session.active",
      "effect": "deny_unless",
      "condition": "session state must equal ACTIVE"
    },
    {
      "rule_id": "rule.session.protocol.exact",
      "effect": "deny_unless",
      "condition": "negotiated protocol version must equal 1.0.0"
    },
    {
      "rule_id": "rule.session.ontology.allowed",
      "effect": "deny_unless",
      "condition": "negotiated ontology version must be allowed and meet capability minimum"
    },
    {
      "rule_id": "rule.flags.no-escalation",
      "effect": "deny_on_escalation",
      "condition": "requested and rule-required flags must be subsets of negotiated flags"
    },
    {
      "rule_id": "rule.semantic.group-capability",
      "effect": "deny_unless",
      "condition": "semantic_id must occur in a capability set allowed to both endpoint groups"
    },
    {
      "rule_id": "rule.cross-group.default-deny",
      "effect": "deny",
      "condition": "cross-group transition must match an explicit bridge rule"
    },
    {
      "rule_id": "rule.same-group.allow",
      "effect": "allow",
      "condition": "after all prior gates, same-group transition is allowed"
    }
  ],
  "bridge_rules": [
    {
      "rule_id": "bridge.ear-to-othala.query",
      "source_domain": "ᛠ.com",
      "target_domain": "ᛟ.com",
      "semantic_ids": [
        "query"
      ],
      "required_flags": [
        "ack-required"
      ],
      "effect": "allow",
      "authority": "first_party_local_policy_fixture"
    },
    {
      "rule_id": "bridge.ear-to-othala.review",
      "source_domain": "ᛠ.com",
      "target_domain": "ᛟ.com",
      "semantic_ids": [
        "proposal.human-review"
      ],
      "required_flags": [
        "human-review"
      ],
      "effect": "allow",
      "authority": "first_party_local_policy_fixture"
    },
    {
      "rule_id": "bridge.othala-to-ear.ack",
      "source_domain": "ᛟ.com",
      "target_domain": "ᛠ.com",
      "semantic_ids": [
        "ack"
      ],
      "required_flags": [
        "ack-required"
      ],
      "effect": "allow",
      "authority": "first_party_local_policy_fixture"
    }
  ],
  "evaluation_order": [
    "rule.policy-version.exact",
    "rule.domain.known",
    "rule.group.claim.exact",
    "rule.session.active",
    "rule.session.protocol.exact",
    "rule.session.ontology.allowed",
    "rule.flags.no-escalation",
    "rule.semantic.group-capability",
    "explicit_bridge_rules",
    "rule.cross-group.default-deny",
    "rule.same-group.allow"
  ],
  "default_effect": "deny",
  "policy_digest_sha256": "5b9cd4f4a945593f0cae7f3681e799b98adacfa8dfb4d09ab7fe3ff5e5976d08"
}