{
  "schema": "NET004_VISIBLE_RULES_v1.1.1",
  "authority": "MAKNOW lesson design, not Microsoft certification",
  "aggregate_rule": "HOSTING_READY only when no issue exists; otherwise HOLD. Success covers this synthetic fixture only.",
  "rules": [
    [
      "INPUT_INVALID",
      "UNKNOWN",
      "Missing or malformed decisive structure, changed fixed exercise contract, or a non-synthetic input cannot receive readiness; obtain a complete conforming evidence record."
    ],
    [
      "CONFIG_MISSING",
      "FAILED",
      "Required configuration value absent, null or blank; do not trust a copied startup PASS."
    ],
    [
      "CONFIG_INVALID",
      "FAILED",
      "Service:Name must be a nonblank JSON string. Timeout must be a positive JSON integer and equal dependency.timeout_ms; booleans, objects and arrays do not satisfy these scalar types."
    ],
    [
      "INTEGRATION_GAP",
      "UNVERIFIED",
      "Exactly the three fixed critical test IDs must be declared and each must occur once, with no extra test rows in this teaching format. Every row needs INTEGRATION, the bound SUT and nonblank string WebApplicationFactory and TestServer references."
    ],
    [
      "TEST_FAILED",
      "FAILED",
      "Each fixed test must retain its declared fixture state and expected result; actual result must match that fixed expectation with result PASS. Changing both expectation and observation does not repair a failed request."
    ],
    [
      "LIFECYCLE_GAP",
      "UNVERIFIED",
      "Startup, shutdown, health and DI scope checks need PASS and non-empty capture references; final host state must be STOPPED. The fixture declares dependency SCOPED and telemetry SINGLETON."
    ],
    [
      "HEALTH_MISMATCH",
      "FAILED",
      "Expected fixture codes: normal readiness 200, dependency unavailable 503, liveness during dependency failure 200."
    ],
    [
      "CORRELATION_GAP",
      "UNVERIFIED",
      "A captured timeout needs matching non-empty 32-digit nonzero hexadecimal trace, log and correlation IDs, plus log event, category, failure class and capture references. diagnostic_fields must identify dependency_timeout and the same trace_id."
    ],
    [
      "METRIC_GAP",
      "UNVERIFIED",
      "Timeout observation needs lesson.dependency.timeouts delta 1 and only operation=dependency tags; request IDs do not belong in metric labels."
    ],
    [
      "SECRET_EXPOSURE_RISK",
      "SECRET_EXPOSURE_RISK",
      "Forbidden field names (case-insensitive) or the trusted synthetic canary anywhere in diagnostic_fields, including dictionary keys and nested values, block readiness. Preserve detectable exposure even when another field makes the input invalid; do not claim absent/unreadable diagnostics were scanned."
    ],
    [
      "PRIVACY_UNVERIFIED",
      "UNVERIFIED",
      "A PASS privacy review and a nonblank JSON string review_ref are required; the canary check does not prove real-world redaction."
    ],
    [
      "CONTEXT_MISMATCH",
      "STALE",
      "Each test, lifecycle and telemetry context must equal the candidate context_id."
    ],
    [
      "NORMAL_PATH_TOO_SLOW",
      "FAILED",
      "normal_delay_ms must be below timeout_ms for the normal-path expectation of 200."
    ],
    [
      "VERSION_REVIEW",
      "REVIEW_REQUIRED",
      "Version review must be CURRENT and not past review_due on the explicit evaluation date."
    ],
    [
      "ACCOUNTABILITY_GAP",
      "UNVERIFIED",
      "Non-empty SUT, environment, hosting profile, reviewer and audit identity are required."
    ]
  ],
  "missing_unrecognized_input": "Malformed evidence emits INPUT_INVALID/UNKNOWN with aggregate HOLD. Missing individual decisive observations use the named rule where possible. Do not invent captures.",
  "fixed_contract": {
    "required_keys": [
      "Service:Name",
      "Dependency:TimeoutMs"
    ],
    "critical_tests": {
      "request_ok": {
        "fixture_state": "NORMAL",
        "expected_status": 200
      },
      "request_timeout": {
        "fixture_state": "TIMEOUT_INJECTED",
        "expected_status": 504
      },
      "missing_config": {
        "fixture_state": "REQUIRED_KEY_REMOVED",
        "expected_status": "STARTUP_REJECTED"
      }
    },
    "forbidden_fields": [
      "authorization",
      "password",
      "secret",
      "token",
      "connection_string"
    ],
    "synthetic_canary": "SYNTHETIC-DO-NOT-LOG-7F2A",
    "target_framework": "net10.0",
    "evidence_kind": "SYNTHETIC",
    "runtime_execution": "NOT_RUN_BY_PUBLISHER"
  },
  "evaluation_date": "Record evaluated_on as YYYY-MM-DD in every submission. Template defaults to today; an explicit --as-of pins a historical exercise date. Grader uses that exact declared date."
}