{
  "schemaVersion": "1.0.0",
  "defaultAction": "deny",
  "sourceAuthorities": {
    "supportedModules": {
      "path": "v3-migration/completeness/supported-v3-modules.json",
      "requiredSchemaVersion": "1.0.0"
    },
    "contractDispositions": {
      "path": "v3-migration/completeness/v2-contract-dispositions.json",
      "requiredRecordCount": 36
    }
  },
  "missionBoundaryClasses": [
    {"id": "objective-control", "protectedDecisionInfluence": true, "unsafeInputsAllowed": false},
    {"id": "financial-control", "protectedDecisionInfluence": true, "unsafeInputsAllowed": false},
    {"id": "role-administration", "protectedDecisionInfluence": true, "unsafeInputsAllowed": false},
    {"id": "emergency-recovery", "protectedDecisionInfluence": true, "unsafeInputsAllowed": false},
    {"id": "informational-only", "protectedDecisionInfluence": false, "unsafeInputsAllowed": false}
  ],
  "allowlist": [
    {"id":"GOV-SELF-PAUSE-TARGET","targetModule":"MultisigGovernanceV3","signature":"addGuardianPauseTarget(address)","selector":"0x6a26895e","maxCalldataBytes":36,"maxValueWei":"0","missionBoundaryClass":"emergency-recovery","requiredAuthority":"governance-threshold-timelock","timelockSecondsMinimum":86400,"argumentConstraints":["target is a deployed supported V3 module","target code hash is release-evidenced"]},
    {"id":"GOV-SELF-GUARDIAN-PROPOSE","targetModule":"MultisigGovernanceV3","signature":"proposeGuardian(address)","selector":"0xc304555f","maxCalldataBytes":36,"maxValueWei":"0","missionBoundaryClass":"role-administration","requiredAuthority":"governance-threshold-timelock","timelockSecondsMinimum":86400,"argumentConstraints":["nonzero","not a governance signer","not treasury","not release attester"]},
    {"id":"GOV-SELF-GUARDIAN-CANCEL","targetModule":"MultisigGovernanceV3","signature":"cancelGuardianRotation()","selector":"0xa9d06116","maxCalldataBytes":4,"maxValueWei":"0","missionBoundaryClass":"role-administration","requiredAuthority":"governance-threshold-timelock","timelockSecondsMinimum":86400,"argumentConstraints":["canonical ABI encoding with no trailing bytes","pending guardian rotation exists"]},
    {"id":"GOV-SELF-SIGNERS","targetModule":"MultisigGovernanceV3","signature":"setSigners(address[],uint256)","selector":"0xb4368904","maxCalldataBytes":1124,"maxValueWei":"0","missionBoundaryClass":"role-administration","requiredAuthority":"governance-threshold-timelock","timelockSecondsMinimum":86400,"argumentConstraints":["canonical ABI encoding with no trailing bytes","at most 32 unique nonzero subjects","threshold at least 3","population at least 5","separation policy satisfied"]},
    {"id":"GOV-SELF-TIMELOCK","targetModule":"MultisigGovernanceV3","signature":"setTimelock(uint256)","selector":"0x1e891c0a","maxCalldataBytes":36,"maxValueWei":"0","missionBoundaryClass":"role-administration","requiredAuthority":"governance-threshold-timelock","timelockSecondsMinimum":86400,"argumentConstraints":["new timelock is not below immutable minimum"]},
    {"id":"GOV-SELF-CALL-POLICY","targetModule":"MultisigGovernanceV3","signature":"setCallPolicy(address,bytes4,bool,uint96,bytes32)","selector":"0xeb76d4d0","maxCalldataBytes":164,"maxValueWei":"0","missionBoundaryClass":"role-administration","requiredAuthority":"governance-threshold-timelock","timelockSecondsMinimum":86400,"argumentConstraints":["canonical ABI encoding with no trailing bytes","target and selector occur in the committed policy","maxValue is zero","expected runtime codehash is nonzero and matches the pinned target","policy update sequence reproduces the candidate commitment"]},
    {"id":"PILOT-CAPS","targetModule":"BasePilotAccessControllerV3","signature":"setCaps(uint256,uint256)","selector":"0x212bf316","maxCalldataBytes":68,"maxValueWei":"0","missionBoundaryClass":"financial-control","requiredAuthority":"governance-threshold-timelock","timelockSecondsMinimum":86400,"argumentConstraints":["not above constructor maxima","not above authorized release caps"]},
    {"id":"PILOT-MODULE","targetModule":"BasePilotAccessControllerV3","signature":"setModule(address,bool)","selector":"0xb1662d58","maxCalldataBytes":68,"maxValueWei":"0","missionBoundaryClass":"objective-control","requiredAuthority":"governance-threshold-timelock","timelockSecondsMinimum":86400,"argumentConstraints":["module appears in supported-v3-modules.json","informational-only module cannot influence protected decisions"]},
    {"id":"PILOT-PARTNER","targetModule":"BasePilotAccessControllerV3","signature":"setDesignPartner(address,bool)","selector":"0x8601ff8b","maxCalldataBytes":68,"maxValueWei":"0","missionBoundaryClass":"objective-control","requiredAuthority":"governance-threshold-timelock","timelockSecondsMinimum":86400,"argumentConstraints":["partner acceptance blocker satisfied before true"]},
    {"id":"PILOT-DEPLOY-ENABLE","targetModule":"BasePilotAccessControllerV3","signature":"setDeployEnabled(bool)","selector":"0x2061314c","maxCalldataBytes":36,"maxValueWei":"0","missionBoundaryClass":"objective-control","requiredAuthority":"governance-threshold-timelock","timelockSecondsMinimum":86400,"argumentConstraints":["true requires deploymentAuthorized and human authorization"]},
    {"id":"PILOT-WRITE-ENABLE","targetModule":"BasePilotAccessControllerV3","signature":"setWriteEnabled(bool)","selector":"0x3a902491","maxCalldataBytes":36,"maxValueWei":"0","missionBoundaryClass":"objective-control","requiredAuthority":"governance-threshold-timelock","timelockSecondsMinimum":86400,"argumentConstraints":["true requires deployed, reconciled, monitored, and separately human-authorized activation"]},
    {"id":"MANDATE-MODULE-AUTH","targetModule":"MandateRegistryV3","signature":"setModuleAuthorization(address,bool)","selector":"0x7db455ce","maxCalldataBytes":68,"maxValueWei":"0","missionBoundaryClass":"objective-control","requiredAuthority":"governance-threshold-timelock","timelockSecondsMinimum":86400,"argumentConstraints":["module appears in supported-v3-modules.json","no unsafe or informational input reaches a protected decision"]},
    {"id":"EVIDENCE-ATTESTER","targetModule":"EvidenceRegistryV3","signature":"setAttester(address,bool)","selector":"0x5c0204d9","maxCalldataBytes":68,"maxValueWei":"0","missionBoundaryClass":"role-administration","requiredAuthority":"governance-threshold-timelock","timelockSecondsMinimum":86400,"argumentConstraints":["role separation and key evidence satisfied"]},
    {"id":"CONSENSUS-ATTESTER","targetModule":"ThresholdConsensusV3","signature":"setAttester(address,bool)","selector":"0x5c0204d9","maxCalldataBytes":68,"maxValueWei":"0","missionBoundaryClass":"role-administration","requiredAuthority":"governance-threshold-timelock","timelockSecondsMinimum":86400,"argumentConstraints":["canonical ABI encoding with no trailing bytes","attester separation and evidence domain satisfied"]},
    {"id":"CONSENSUS-THRESHOLD","targetModule":"ThresholdConsensusV3","signature":"setThreshold(uint8)","selector":"0xe5a98603","maxCalldataBytes":36,"maxValueWei":"0","missionBoundaryClass":"role-administration","requiredAuthority":"governance-threshold-timelock","timelockSecondsMinimum":86400,"argumentConstraints":["canonical ABI encoding with no trailing bytes","threshold at least 3 for the pilot","threshold does not exceed evidenced attester population"]},
    {"id":"SAFE-FACTORY-CONFIGURE","targetModule":"SafeBondFactoryV3","signature":"configureFactories(address,address)","selector":"0x39800d46","maxCalldataBytes":68,"maxValueWei":"0","missionBoundaryClass":"objective-control","requiredAuthority":"governance-threshold-timelock","timelockSecondsMinimum":86400,"argumentConstraints":["canonical ABI encoding with no trailing bytes","both target runtime hashes and immutable parameters match the candidate"]},
    {"id":"SAFE-FACTORY-DEPLOY-GATE","targetModule":"SafeBondFactoryV3","signature":"setDeployAllowed(bool)","selector":"0x3a281eb8","maxCalldataBytes":36,"maxValueWei":"0","missionBoundaryClass":"objective-control","requiredAuthority":"governance-threshold-timelock","timelockSecondsMinimum":86400,"argumentConstraints":["canonical ABI encoding with no trailing bytes","true requires deploymentAuthorized and human deployment authorization"]},
    {"id":"SAFE-FACTORY-DEPLOY-PARTNERSHIP","targetModule":"SafeBondFactoryV3","signature":"deployPartnership(address,address)","selector":"0xc4dac5fa","maxCalldataBytes":68,"maxValueWei":"0","missionBoundaryClass":"financial-control","requiredAuthority":"governance-threshold-timelock","timelockSecondsMinimum":86400,"argumentConstraints":["canonical ABI encoding with no trailing bytes","reward program is zero","design partner is candidate-authorized","deployment and cap gates are true"]},
    {"id":"SAFE-FACTORY-DEPLOY-ACCOUNTABILITY","targetModule":"SafeBondFactoryV3","signature":"deployAccountability(address)","selector":"0x8697c874","maxCalldataBytes":36,"maxValueWei":"0","missionBoundaryClass":"financial-control","requiredAuthority":"governance-threshold-timelock","timelockSecondsMinimum":86400,"argumentConstraints":["canonical ABI encoding with no trailing bytes","factory and child runtime hashes equal the candidate-authorized immutable hashes","design partner is candidate-authorized","deployment and cap gates are true"]}
  ],
  "denylist": [
    {"id":"DENY-UNKNOWN","match":{"notExplicitlyAllowlisted":true},"reason":"Unknown targets, selectors, overloads, and calldata are denied by default."},
    {"id":"DENY-NATIVE-VALUE","match":{"valueWeiGreaterThan":"0"},"reason":"No allowlisted governance operation may attach native value."},
    {"id":"DENY-UNSAFE-INPUT","match":{"inputClassIn":["belief","flourishing","reputation","trust-score","behavioral-routing"]},"reason":"Unsafe capability classes may not influence protected decisions directly or transitively."},
    {"id":"DENY-INFORMATIONAL-MUTATION","match":{"targetCapabilityTag":"reputation"},"reason":"Informational reputation modules are not governance inputs or protected-decision controls."},
    {"id":"DENY-SYBIL-FLAG","match":{"selector":"0xc5e7a20e","signature":"setSybilFlag(bytes32,bool)"},"reason":"Subjective or inferred flags cannot control V3 protected decisions."},
    {"id":"DENY-SIGNAL-ADD","match":{"selector":"0x39b80a79","signature":"addSignal(bytes32,(uint8,uint16,uint64,bytes32))"},"reason":"Reputation signals remain informational and cannot enter governance execution."},
    {"id":"DENY-SIGNAL-RECOMPUTE","match":{"selector":"0xca1921f3","signature":"recompute(bytes32,uint256)"},"reason":"Computed reputation cannot be elevated into governance authority."},
    {"id":"DENY-DIRECT-UNPAUSE","match":{"selector":"0x3f4ba83a","signature":"unpause()"},"reason":"Recovery requires a separately reviewed, timelocked governance proposal and completed reconciliation; generic selector execution is not allowlisted."},
    {"id":"DENY-OWNER-TRANSFER","match":{"selector":"0x13af4035","signature":"setOwner(address)"},"reason":"Ownership changes require the dedicated deployment or recovery drill and are not routine governance calls."},
    {"id":"DENY-MUTUAL-AID-SKIM","match":{"selector":"0x68d90d56","signature":"skimSurplus(address,uint256)","targetModule":"MutualAidPoolV3"},"reason":"The exact two-argument source signature is recognized but denied because MutualAidPoolV3 is outside the remediated supported set."}
  ],
  "prohibitedInputClasses": ["belief","flourishing","reputation","trust-score","behavioral-routing"]
}
