{
  "schema": "NET002_VISIBLE_RULES_v1",
  "authority": "MAKNOW exercise design, with platform facts cited separately",
  "aggregate_rule": "VERIFIED_SYNTHETIC only if all required dimensions pass; otherwise HOLD. No real ASP.NET Core execution or deployment permission is implied.",
  "rules": [
    [
      "INPUT_INVALID",
      "UNKNOWN",
      "Malformed critical structure or changed evidence kind cannot establish this bounded result."
    ],
    [
      "IDENTITY_GAP",
      "UNVERIFIED",
      "Nonblank revision, context, audit and test-host identities and the supplied model source digest are required."
    ],
    [
      "CONTRACT_CHANGED",
      "REVIEW_REQUIRED",
      "The selected profile and contract digest must match contracts.json; changing the expected contract is a new reviewed exercise."
    ],
    [
      "IMPLEMENTATION_MISMATCH",
      "FAILED",
      "All endpoint fields, schema definitions, chosen style, pipeline order and fixed controls must match the selected visible profile."
    ],
    [
      "AUTHORIZATION_GAP",
      "FAILED",
      "Every endpoint must retain its declared authorization policy; route/OpenAPI presence does not establish enforcement."
    ],
    [
      "AUTH_BOUNDARY_FAILURE",
      "FAILED",
      "Unauthenticated and forbidden probes must neither succeed nor write data; preserve this cause even when unrelated input is malformed."
    ],
    [
      "CASE_COVERAGE_GAP",
      "UNVERIFIED",
      "Every required case ID occurs exactly once, with no unknown extras."
    ],
    [
      "CASE_EVIDENCE_GAP",
      "UNVERIFIED",
      "Every case needs PASS, a nonblank capture, exact request digest and the declared Python-model execution kind."
    ],
    [
      "RESPONSE_CONTRACT_FAILURE",
      "FAILED",
      "Statuses, content types, safe typed bodies, required headers, response identities and pipeline trace must match the supplied requests and visible expectations."
    ],
    [
      "SIDE_EFFECT_FAILURE",
      "FAILED",
      "Write count, dependency-call count and final rows must match each case, including retries and rejections."
    ],
    [
      "ERROR_DISCLOSURE_RISK",
      "FAILED",
      "No stack/exception/debug/connection-string field or synthetic private-stack canary may occur in response bodies; inspect nested keys and values."
    ],
    [
      "IDEMPOTENCY_UNVERIFIED",
      "UNVERIFIED",
      "Require the process-locked actor/method/route/key map, payload comparison and process-lifetime scope; baseline sequential/concurrent/cross-actor probes must preserve the declared effects."
    ],
    [
      "OPENAPI_STALE",
      "STALE",
      "Generated document, implementation hash, contract hash, context and OpenAPI 3.1.1 evidence must agree; compare paths, security metadata, schemas and responses, not file existence."
    ],
    [
      "CONTEXT_STALE",
      "STALE",
      "Every capture and review must match context_id, contract_digest (selected profile), implementation_digest (candidate metadata), and test_host_source_sha256 (actual model source). A missing or mismatched review association is CONTEXT_STALE / STALE."
    ],
    [
      "PATCH_SEMANTICS_UNVERIFIED",
      "UNVERIFIED",
      "The R2 profile requires the separately specified PATCH shape, media type, omit/null rules and absolute-assignment semantics; POST cannot be copied."
    ],
    [
      "DEPENDENCY_UNVERIFIED",
      "UNVERIFIED",
      "R2 requires a bounded 100 ms synthetic read-only background-availability probe, 503 on timeout, no local write and its own negative cases."
    ],
    [
      "REVIEW_GAP",
      "REVIEW_REQUIRED",
      "A named synthetic reviewer and nonblank review reference are required; this is not production owner approval."
    ],
    [
      "VERSION_REVIEW",
      "REVIEW_REQUIRED",
      "Use net10.0 / ASP.NET Core major 10 and an unexpired CURRENT review on the visible evaluation date."
    ]
  ],
  "contracts_ref": "contracts.json",
  "input_contract": "Strict JSON types, exact profile selection and SHA-256 bindings. Model execution is distinct from framework execution.",
  "date_policy": "Record evaluated_on; --as-of is visible historical reproduction only.",
  "contracts_sha256": "1e0b3134f311c2248422bec5580afe50e9a45e48b6bcffc5cce8d1b97b178fd0"
}