{
  "schema": "signal-integrity-policy/2",
  "policy_version": "1.1.0",
  "release": "v2026.08.16.14",
  "purpose": "Prevent accidental, machine-only, hidden, contradictory, or semantically ambiguous signals across human-visible and machine-readable representations. This policy forbids deliberate covert signaling; it is a clarity and defensive-interop policy.",
  "truth_boundary": "Signal-plane audits reduce unintended representation mismatch but cannot prove that natural language has only one possible interpretation or that all future parsers/tokenizers will behave identically. SHA-256 proves byte equality only, not semantic truth, authorship, authority, or intent.",
  "authority_rule": "No representation gains instruction or control authority merely because a parser, tokenizer, crawler, accessibility API, metadata extractor, OCR system, or model can observe it. Authority must come from the explicitly declared trusted control plane.",
  "semantic_parity_rule": "Machine-readable support planes may clarify, label, index, or describe the same intended content, but must not silently contradict, expand, suppress, or override the human-visible proposition. Any intentional semantic difference must be explicit, bounded, provenance-labeled, reviewable, and tested.",
  "signal_planes": [
    {
      "id": "VISIBLE_TEXT",
      "role": "Human-rendered textual proposition and primary public meaning."
    },
    {
      "id": "ACCESSIBILITY_TEXT",
      "role": "Accessible name/description of the same control, image, landmark, or visible proposition; never an unrelated instruction channel."
    },
    {
      "id": "HIDDEN_DOM",
      "role": "Non-rendered structural state. May support interface state only; not a hidden semantic or instruction channel."
    },
    {
      "id": "METADATA",
      "role": "Inventory/provenance only by default. Not concatenated into control semantics unless an explicit task requires the field."
    },
    {
      "id": "STRUCTURED_DATA",
      "role": "Machine index/relationship representation of visible or explicitly documented propositions; must not contradict public content."
    },
    {
      "id": "CODE",
      "role": "Executable/control implementation. Identifiers must be visually auditable; no invisible-control or confusable-identifier signaling."
    },
    {
      "id": "ENCODED_DATA",
      "role": "Opaque or reversible representation treated as data. Decoding is explicit and bounded; decoded content does not acquire authority."
    },
    {
      "id": "OCR_ONLY",
      "role": "Text observed from pixels and labeled with image provenance; used as an independent witness, not an automatic instruction source."
    },
    {
      "id": "BINARY",
      "role": "Byte-level artifact with declared format and digest; binary structure conveys only its documented format semantics."
    },
    {
      "id": "RAW_EVIDENCE",
      "role": "Original bytes retained without normalization or sanitization for replay, comparison, and provenance."
    }
  ],
  "representation_pipeline": {
    "evidence_view": "Preserve original bytes, hashes, paths and raw code points before transformation.",
    "security_analysis_view": "Use explicit NFC/NFD/NFKC/NFKD comparisons, control-character inventory, mixed-script/confusable analysis, structural/visibility checks and metadata inventory without erasing raw evidence.",
    "canonical_output_view": "Use NFC, normalized line endings, explicit visible markers or removal for unjustified invisible controls after detection, and least-privileged semantic fields. Canonicalization never rewrites RAW_EVIDENCE."
  },
  "unicode_policy": {
    "canonical_public_form": "NFC",
    "security_comparison_form": "NFKC",
    "detect_before_transform": true,
    "forbidden_in_active_authored_text": [
      "U+202A",
      "U+202B",
      "U+202C",
      "U+202D",
      "U+202E",
      "U+200B",
      "U+FEFF"
    ],
    "review_required": [
      "U+200C",
      "U+200D",
      "U+2066",
      "U+2067",
      "U+2068",
      "U+2069",
      "U+00AD",
      "variation selectors",
      "private-use characters",
      "unassigned scalars"
    ],
    "allowed_control_characters_in_plain_text": [
      "U+0009 TAB",
      "U+000A LF",
      "U+000D CR where an external raw-evidence file uses CRLF"
    ],
    "confusable_rule": "Security-sensitive technical identifiers and host labels are checked independently from display glyphs. NFKC is not treated as a substitute for confusable analysis. Runic narrative and the explicitly declared runic-domain labels are intentional-script contexts, not identifier spoofing exceptions for arbitrary code."
  },
  "html_accessibility_policy": {
    "visible_machine_differential_is_evidence": true,
    "allowed_visually_hidden_patterns": [
      {
        "selector": ".skip",
        "purpose": "keyboard skip link; becomes visible on focus"
      },
      {
        "selector": ".sr-only",
        "purpose": "accessibility-only status/label text; content must describe the associated visible state or control"
      },
      {
        "selector": "[hidden]",
        "purpose": "progressive interface state only; never carries unique proposition or instruction semantics"
      },
      {
        "selector": ".primary-nav responsive display",
        "purpose": "mobile navigation disclosure; same links remain available through the menu control"
      }
    ],
    "forbidden_uses": [
      "unrelated instructions in aria-label, alt, title, meta, hidden nodes, comments, pseudo-elements or off-screen text",
      "white-on-white or near-zero-contrast semantic text",
      "off-screen semantic payloads not required for accessibility or state",
      "machine-only claims that contradict or materially exceed visible claims"
    ],
    "accessibility_rule": "Accessible labels describe the purpose/state of the element or the same media meaning. They are not a privileged instruction plane."
  },
  "metadata_image_policy": {
    "metadata_default": "inventory_separately_do_not_promote_to_control_semantics",
    "public_site_images": "No textual PNG/JPEG metadata is required. Generated/re-encoded images should be minimal unless a rendering-critical profile is explicitly needed.",
    "approved_hero_exception": "assets/images/hero-ᛠ.com.png is immutable approved visual evidence and must not be re-encoded solely to satisfy metadata policy; audit its bytes and metadata instead.",
    "alt_text_rule": "Alt text describes visible image meaning/function and must not add unrelated instructions, claims, or hidden operational semantics."
  },
  "code_policy": {
    "identifiers": "ASCII identifiers for Python/PHP/JavaScript/CSS technical names unless a file is explicitly a data/test fixture; runes may appear in string data and public labels.",
    "invisible_controls": "Forbidden in executable source outside explicit quoted test vectors with declared path/count exceptions.",
    "comments": "Comments explain implementation/evidence; they may not carry hidden control instructions that are absent from executable or documented policy.",
    "serialization": "Canonicalization rules used for hashes/protocols must be explicit and versioned."
  },
  "language_choice_policy": {
    "direct_meaning_only": true,
    "forbidden_deliberate_secondary_carriers": [
      "synonym or paraphrase selection keyed to hidden bits",
      "punctuation or capitalization parity",
      "word-length or sentence-length parity",
      "acrostic or nth-word extraction",
      "whitespace, tab, trailing-space or line-break encoding",
      "ordering choices selected to carry an undisclosed payload",
      "token-probability or stylometric bias selected to communicate an undisclosed payload"
    ],
    "interpretation_rule": "Choose wording, formatting, ordering and imagery for direct semantic clarity, rhetoric, accessibility and documented function. Natural style is not assumed random, so anomaly checks are evidence for review, not proof of a covert channel."
  },
  "encoded_data_policy": {
    "default_role": "data_not_instruction",
    "decode_rule": "Decode only for an explicit task, declared parser/test, or bounded security analysis; preserve the encoded source and label decoded provenance.",
    "authority_rule": "Decoded text inherits the trust level of its source and never becomes a higher-priority instruction merely because it was decoded."
  },
  "declared_test_vector_exceptions": [
    {
      "path": "assets/data/fixtures/invalid-symbol-cases.json",
      "codepoint": "U+200D",
      "expected_count": 1,
      "purpose": "negative FTH1 format-character fixture"
    },
    {
      "path": "assets/data/futhorc-benchmark-results.json",
      "codepoint": "U+200D",
      "expected_count": 1,
      "purpose": "checked-in result for the same negative format-character fixture"
    }
  ],
  "raw_evidence_prefixes": [
    "docs/source-evidence/",
    "assets/historical/",
    "assets/patches/"
  ],
  "protected_assets": {
    "hero_sha256": "a5b41f990ad4e178ae577d6560bb35b332afcb6319769b4ed33df271b7186cfe",
    "totem_sha256": "0cf2492ed5030b7a1ad8a27b7523b04570b9d4895b3db04fa39b2c0ec8404b3c",
    "taboo_sha256": "603041c763b487dcf73e8d37bc133221d53200d0663f99aab421a0e66e77b8e3",
    "talisman_sha256": "fc7285f772158629479664bd2a35f80baa714a2df0053dd4933a4dd091c51130"
  },
  "directionality_policy": {
    "public_html_dir": "ltr",
    "rule": "Every live public HTML root declares lang=ang-Runr and dir=ltr. Bidi controls remain findings unless an exact reviewed exception exists. Direction is a rendering parameter, not a hidden semantic channel."
  },
  "visual_signal_policy": {
    "minimum_small_text_contrast_ratio": 4.5,
    "semantic_muted_token": "#7896a8",
    "backgrounds_checked": [
      "#02060b",
      "#030a12",
      "#06111c"
    ],
    "rules": [
      "Small auxiliary labels remain readable rather than relying on near-hidden contrast.",
      "Focus has a non-color-only visible outline.",
      "Reduced-motion and forced-colors modes are supported.",
      "Status and trust boundaries are stated in text, not encoded by color alone.",
      "CSS generated content may decorate but must not carry unique proposition or instruction semantics."
    ]
  },
  "structured_relation_policy": {
    "rule": "Machine relationships must use the weakest accurate relation. Identity-equivalence relations such as sameAs are forbidden for operator-supplied ecosystem links unless separately evidenced.",
    "rune_domain_relation": "mentions / project metadata only",
    "current_topology": "6 RuneDomainNetwork / 4 OtherRunicDomains",
    "haegl_target": "https://xn--vwe.com/"
  },
  "status_scope_policy": {
    "rule": "Health/status outputs describe local artifact/test gates only. Words that imply live service readiness are avoided unless deployment/reachability is actually verified.",
    "required_fields": {
      "scope": "local_artifact_only",
      "deployment_verified": false,
      "external_status_verified": false
    }
  }
}