{
  "schemaVersion": "1.0.0",
  "status": "controls-defined-not-staffed-not-authorized",
  "guardian": {
    "allowedAction": "guardianPause(address)",
    "targetRule": "target must be a pre-authorized deployed supported V3 module with evidenced code hash",
    "forbiddenActions": ["unpause","execute governance proposal","change roles","change caps","enable deploy or writes","move funds","rotate guardian"],
    "pauseEffectsRequired": ["block new risk-increasing writes","preserve withdrawals or refunds where safely possible","emit observable state","open incident record"],
    "recovery": {
      "authority": "governance-threshold-timelock",
      "minimumDelaySeconds": 86400,
      "requiredBeforeUnpause": ["root cause recorded","patched or mitigated candidate evidenced","liability and credit reconciliation passes","all dependent paused states checked","monitoring green for rehearsal window","release-attester evidence present","separate human activation authorization recorded"],
      "noEmergencyBypass": true
    }
  },
  "incidentSeverities": [
    {"id":"SEV-0","definition":"confirmed or credible imminent loss of custody, unauthorized activation, governance compromise, or cross-chain settlement divergence","acknowledgeMinutes":5,"containMinutes":15,"actions":["page both responder groups","guardian pause bounded targets when applicable","freeze activation progression","preserve logs and state snapshots","begin liability reconciliation"]},
    {"id":"SEV-1","definition":"material invariant failure, receipt-store corruption, persistent reorg exposure, cap breach, or unavailable threshold path","acknowledgeMinutes":15,"containMinutes":60,"actions":["page both responder groups","halt releases and settlement","assess bounded pause","preserve evidence","open reconciliation"]},
    {"id":"SEV-2","definition":"degraded monitoring, stale evidence, delayed settlement, or noncritical reconciliation mismatch without current loss indication","acknowledgeMinutes":60,"containMinutes":240,"actions":["assign incident record","block evidenceComplete","repair observation coverage","reconcile affected window"]},
    {"id":"SEV-3","definition":"operational defect with no protected-decision, custody, settlement, privacy, or availability impact","acknowledgeMinutes":240,"containMinutes":1440,"actions":["record and schedule correction","confirm no escalation indicators"]}
  ],
  "runbooks": [
    {"id":"IR-GOVERNANCE-COMPROMISE","triggers":["unexpected proposal or confirmation","role overlap","key compromise"],"steps":["classify severity","pause bounded targets if risk increasing","revoke or rotate affected subjects","invalidate pending unsafe actions","reconcile all actions since last trusted checkpoint","require timelocked recovery and separate activation authorization"]},
    {"id":"IR-LIABILITY-DIVERGENCE","triggers":["assets below liabilities","credit insolvency","cap exceeded"],"steps":["halt activation and new risk","snapshot balances and liabilities","identify first divergent block or slot","reconcile credits and pending payouts","prepare bounded remediation","independently attest restored invariants"]},
    {"id":"IR-REORG","triggers":["finalized transaction disappears","canonical hash changes beyond tolerance"],"steps":["mark evidence stale","stop dependent settlement","re-read canonical history after finality threshold","reconcile duplicate or missing effects","refresh evidence before resuming"]},
    {"id":"IR-RECEIPT-STORE","triggers":["receipt write/read mismatch","duplicate settlement identity","unavailable store"],"steps":["stop x402 acceptance and Bazaar readiness claims","preserve request and settlement identities without prohibited payloads","reconcile durable receipts to settlement evidence","test replay rejection","require fresh partner acceptance evidence"]},
    {"id":"IR-SOLANA-AUTHORITY","triggers":["program hash mismatch","unexpected executable owner","upgrade authority mismatch"],"steps":["block Solana activation and cross-chain claims","record program data and authority observation","compare with authorized manifest","escalate as governance compromise if changed","require independent build and deployment evidence"]},
    {"id":"IR-PRIVACY","triggers":["prohibited input observed","unexpected personal data retained","privacy signoff withdrawn"],"steps":["stop affected ingestion","preserve minimal forensic evidence","remove decision influence","perform data-flow assessment","keep privacy blocker open until external signoff"]}
  ],
  "monitoring": [
    {"id":"MON-LIABILITIES","scope":["VaultfireBIPVaultV3","MutualAidPoolV3","TaskEscrowV3","DisputeRegistryV3"],"definition":"assets per asset must be greater than or equal to explicit liabilities plus withdrawable credits","cadenceSeconds":60,"alertSeverity":"SEV-0","reconciliationEvidence":"per-asset state snapshot with block identity"},
    {"id":"MON-CREDITS","scope":["all pull-payment modules"],"definition":"sum of address credits equals recorded aggregate credit liability and every withdrawal reduces both exactly once","cadenceSeconds":60,"alertSeverity":"SEV-1","reconciliationEvidence":"credit ledger aggregate and sampled holder proofs"},
    {"id":"MON-CAPS","scope":["BasePilotAccessControllerV3","bond factories","MutualAidPoolV3"],"definition":"global and per-position exposure never exceed constructor and release-authorized caps","cadenceSeconds":30,"alertSeverity":"SEV-0","reconciliationEvidence":"cap values, allocations, and release status hash"},
    {"id":"MON-PAUSED-STATES","scope":["all activated supported modules"],"definition":"paused state, controller gates, deploy gates, and write gates agree with the authorized activation record","cadenceSeconds":30,"alertSeverity":"SEV-0","reconciliationEvidence":"state vector and triggering proposal evidence"},
    {"id":"MON-RECEIPT-STORE","scope":["x402 receipt store"],"definition":"durable receipt availability, uniqueness, replay rejection, and settlement identity binding","cadenceSeconds":60,"alertSeverity":"SEV-1","reconciliationEvidence":"receipt counts, duplicate scan, read-after-write evidence, settlement comparison"},
    {"id":"MON-REORG","scope":["Base","Solana","x402 settlement evidence"],"definition":"observed block or slot identity remains canonical through the configured finality threshold","cadenceSeconds":30,"alertSeverity":"SEV-1","reconciliationEvidence":"before/after canonical identities and affected event replay"},
    {"id":"MON-SOLANA-PROGRAM","scope":["supported Solana programs"],"definition":"program id, executable owner, program-data hash, upgrade authority, and deployment slot match the authorized release record","cadenceSeconds":300,"alertSeverity":"SEV-0","reconciliationEvidence":"independently captured program and program-data observations"},
    {"id":"MON-X402-SETTLEMENT","scope":["x402 settlement","Bazaar publication"],"definition":"request identity, payment requirements, payer evidence, settlement result, durable receipt, route metadata, and Bazaar publication evidence bind to one release and contain no prohibited input","cadenceSeconds":60,"alertSeverity":"SEV-1","reconciliationEvidence":"privacy-minimized evidence chain with freshness timestamps"}
  ],
  "drills": [
    {"id":"DRILL-DEPLOYMENT","environment":"isolated non-mainnet rehearsal only","prohibited":["wallet signing","RPC broadcast","mainnet activation"],"steps":["pin source and artifact hashes","validate 17 supported modules and 36 dispositions","validate role separation without key material","generate selector-bounded proposals without signing","simulate deployment order","verify ownership, caps, pause coverage, code hashes, and default-disabled gates","reconcile zero-risk initial state","record failures and rollback checkpoints"],"passCriteria":["all checks deterministic","no unsupported module included","all gates disabled","no transaction signed or broadcast","fresh evidence recorded"]},
    {"id":"DRILL-ROLLBACK","environment":"isolated non-mainnet rehearsal only","prohibited":["wallet signing","RPC broadcast","mainnet activation"],"steps":["inject failure after each deployment checkpoint","halt subsequent steps","simulate guardian pause for bounded targets","verify deploy and write gates remain false","reconcile liabilities and credits","exercise timelocked recovery plan without execution","prove stale authorization cannot activate"],"passCriteria":["no risk-increasing action after injected failure","recovery remains bounded and delayed","reconciliation evidence complete","separate activation authorization remains required"]}
  ],
  "freshness": {
    "canonicalStatusMaximumAgeHours": 24,
    "sourceEvidenceMaximumAgeHours": 24,
    "operationsEvidenceMaximumAgeHours": 24,
    "externalSignoffMaximumAgeDays": 30,
    "authorizationMaximumAgeHours": 24,
    "futureTimestampsRejected": true
  },
  "prohibitedEvidenceInputs": ["wallet secrets","private keys","seed phrases","raw personal data not required for the invariant","belief","flourishing","reputation","trust-score","behavioral-routing"]
}
