{ "schemaVersion": 1, "asOf": "2026-08-25", "classification": "controlled-source-staged", "gatewayContractVersion": "mirmc-network-gateway-v1", "attestationMaxAgeSeconds": 90, "sourceArchitecture": { "registeredPrivilegedSurfaces": 9, "serverBoundarySurfaces": 9, "networkEvaluatedSurfaces": 9, "networkEvaluationCoveragePct": 100, "knownDirectBypasses": 0, "sourceBypassClosureReady": true, "sourceDirectRpcBypassEliminated": true, "auditExportTerminalAuthority": "agency_audit_export_gateway_v5", "privilegedRpcAuthority": "gateway-v3-wrappers", "historicalPreSignTenantAuthority": "gateway-pre-sign-tenant-authority-v11", "historicalReleaseLeasePreSignAuthority": "gateway-release-lease-pre-sign-v15", "historicalCanonicalLeaseContinuityPreSignAuthority": "gateway-canonical-lease-continuity-pre-sign-v17", "preSignTenantAuthority": "gateway-complete-release-binding-pre-sign-v18", "preSignActorBindingRequired": true, "preSignBillingReadinessRequiredAal": "aal1", "preSignPrivilegedActionsRequiredAal": "aal2", "preSignPrivilegedActionCount": 13, "preSignMissingAssuranceFailsClosed": true, "evidenceLedgerAuthority": "hash-bound-ledger-v6", "historicalReviewAuthority": "gateway-v7-aal2-two-reviewer", "historicalReadinessAuthority": "gateway-v8-aal2-readiness-snapshot", "historicalPolicyFingerprintAuthority": "network-policy-fingerprint-v9", "historicalSupersessionAuthority": "latest-evidence-pack-v11", "historicalRuntimeControlAuthority": "runtime-control-binding-v12", "historicalCloudflareReleaseAuthority": "cloudflare-production-release-binding-v13", "historicalCloudflareProbeFreshnessAuthority": "cloudflare-probe-freshness-anchor-v14", "historicalReleaseLeaseAuthority": "cloudflare-release-lease-v15", "historicalReleaseCanonicalizationAuthority": "cloudflare-release-canonicalization-v16", "historicalCanonicalLeaseContinuityAuthority": "canonical-lease-continuity-v17", "activationAuthority": "complete-release-binding-fingerprint-v18", "cloudflareReleaseRecorderAuthority": "complete-release-binding-fingerprint-v18", "releaseLeaseRevalidationAuthority": "complete-release-binding-revalidation-v18", "evidenceReviewAuthority": "latest-evidence-pack-v11", "readinessAuthority": "complete-release-binding-readiness-v18", "antiAbuseRateLimitAuthority": "nonce-ledger-rate-limit-v10", "signedGatewayActionCount": 14, "unknownGatewayActionsDenied": true, "actorAndOrganizationMinuteHourLimitsDefined": true, "concurrentRateChecksSerializedInSource": true, "evidencePackReceiptsRequired": 4, "persistedLedgerReceiptTypesRequired": 6, "requiredStagingGatewayMigrationCount": 18, "independentEvidenceApprovalsRequired": 2, "policyFingerprintBoundReviewsRequired": true, "reviewFreshnessHours": 24, "latestPassedEvidencePackRequired": true, "supersededEvidencePackActivationAllowed": false, "reviewQuorumExpiryReported": true, "stagingRateLimitProbeRequired": true, "stagingSupersededPackProbeRequired": true, "stagingCloudflareFreshnessAnchorProbeRequired": true, "stagingReleaseLeaseExpiryProbeRequired": true, "stagingReleaseRollbackMismatchProbeRequired": true, "stagingReleaseCanonicalizationProbeRequired": true, "stagingCanonicalLeaseContinuityProbeRequired": true, "stagingCompleteReleaseBindingFingerprintProbeRequired": true, "cloudflareProductionReleaseReceiptRequired": true, "cloudflareReleaseFreshnessMinutes": 15, "cloudflareRequiredProductionProbeCount": 7, "cloudflareProbeFreshnessAnchorRequired": true, "cloudflareOldestProbeAnchorsFreshness": true, "cloudflareEvaluationTimeMayExtendFreshness": false, "exactCloudflareSourceCommitBindingRequired": true, "exactCloudflareVersionBindingRequired": true, "releaseCanonicalizationRequired": true, "cloudflareReadinessPackScoped": true, "unrelatedNewerReleaseMayBlockCurrentPackReadiness": false, "releaseLeaseRequiredWhenEnforce": true, "releaseLeaseMaxMinutes": 15, "releaseLeaseMayOutliveProbeFreshness": false, "confirmedReleaseDriftRequiresRevalidation": true, "canonicalLeaseContinuityRequiredWhenEnforce": true, "historicalNonCanonicalReleaseMayRenewLease": false, "completeReleaseBindingFingerprintRequired": true, "completeReleaseBindingFingerprintVersion": 18, "completeReleaseBindingFingerprintRecomputedBeforeHmac": true, "completeReleaseBindingFingerprintRecomputedBeforeLeaseRenewal": true, "completeReleaseBindingFingerprintCoversVersionTagAndChronology": true, "automaticDowngradeToObserveEnabled": false }, "runtimeEvidence": { "sourceChecksExecutionClaimed": false, "coordinatedSecretProvisioningVerified": false, "stagingConformanceVerified": false, "measuredObserveCanaryPassed": false, "runtimeActivationEvidencePresent": false, "productionDirectRpcBypassEliminationVerified": false, "preSignTenantAuthorityRuntimeVerified": false, "evidenceLedgerRuntimeVerified": false, "independentEvidenceReviewsVerified": false, "readinessSnapshotRuntimeVerified": false, "policyFingerprintReviewRuntimeVerified": false, "evidenceSupersessionRuntimeVerified": false, "reviewQuorumFreshnessRuntimeVerified": false, "rateLimitRuntimeVerified": false, "stagingRateLimitProbeVerified": false, "stagingSupersededPackProbeVerified": false, "stagingCloudflareFreshnessAnchorProbeVerified": false, "stagingReleaseLeaseExpiryProbeVerified": false, "stagingReleaseRollbackMismatchProbeVerified": false, "stagingReleaseCanonicalizationProbeVerified": false, "stagingCanonicalLeaseContinuityProbeVerified": false, "stagingCompleteReleaseBindingFingerprintProbeVerified": false, "runtimeControlBindingVerified": false, "cloudflareProductionReleaseBindingVerified": false, "cloudflareProbeFreshnessRuntimeVerified": false, "cloudflareReleaseCanonicalizationRuntimeVerified": false, "packScopedCloudflareReadinessRuntimeVerified": false, "exactProductionReleaseRuntimeVerified": false, "releaseLeaseRuntimeVerified": false, "releaseLeaseRevalidationRuntimeVerified": false, "canonicalLeaseContinuityRuntimeVerified": false, "completeReleaseBindingFingerprintRuntimeVerified": false, "leasedReleaseBindingFingerprintRuntimeVerified": false, "productionRollbackDetectionRuntimeVerified": false, "productionRateLimitActivationClaimed": false, "productionEnforceReady": false, "productionEnforcementClaimed": false }, "evidenceProtocol": { "sourceClosureReceipt": "enterprise-network-gateway-source-closure-v1", "secretParityReceipt": "enterprise-network-gateway-secret-parity-v1", "stagingConformanceReceipt": "enterprise-network-gateway-staging-conformance-v1", "measuredCanaryReceipt": "enterprise-network-gateway-canary-v1", "cloudflareProductionReleaseReceipt": "cloudflare-production-release-receipt-v1", "exactByteSha256Binding": true, "persistedEvidencePackRequired": true, "twoIndependentAal2ReviewsRequired": true, "policyVersionBoundReviewRequired": true, "normalizedCidrFingerprintRequired": true, "reviewedSourceCommitBindingRequired": true, "preSignTenantAuthorityRequiredBeforeHmac": true, "preSignActorMustMatchJwt": true, "preSignAssuranceMustBePresent": true, "preSignNoPolicyRlsFallback": true, "reviewFreshnessWindowHours": 24, "latestPassedPackOnly": true, "historicalEvidenceRetainedForAudit": true, "supersededPackReviewAllowed": false, "supersededPackActivationAllowed": false, "evidenceAndReviewTablesLockedDuringTerminalActivationValidation": true, "policyLockedDuringActivationValidation": true, "currentStagingMigrationLineageBound": true, "stagingRateLimitProbePersisted": true, "stagingSupersededPackProbePersisted": true, "stagingCloudflareFreshnessAnchorProbePersisted": true, "stagingReleaseLeaseExpiryProbePersisted": true, "stagingReleaseRollbackMismatchProbePersisted": true, "stagingReleaseCanonicalizationProbePersisted": true, "stagingCanonicalLeaseContinuityProbePersisted": true, "stagingCompleteReleaseBindingFingerprintProbePersisted": true, "exactCloudflareSourceCommitRequired": true, "exactCloudflareProductionVersionRequired": true, "freshCloudflareProductionProbesRequired": true, "cloudflareReleaseReceiptMustBindCurrentEvidencePack": true, "oldestCloudflareProbeDefinesFreshness": true, "cloudflareEvaluationCannotRejuvenateProbeFreshness": true, "sameHashHistoricalReleaseMayOnlyCanonicalizeBackward": true, "canonicalizationRequiresImmutableReleaseBindings": true, "readinessSelectsCloudflareReleaseWithinCurrentEvidencePack": true, "releaseLeaseBoundToPolicyVersion": true, "releaseLeaseBoundToEvidencePack": true, "releaseLeaseBoundToSourceCommit": true, "releaseLeaseBoundToCloudflareVersion": true, "releaseLeaseCannotOutliveCloudflareProbeFreshness": true, "releaseDriftFailsClosedBeforeHmac": true, "leaseRevalidationRequiresLatestPassedPack": true, "leaseRevalidationRequiresCanonicalV16Release": true, "preSignRequiresCurrentCanonicalRelease": true, "activationRollsBackOnLeaseCanonicalMismatch": true, "completeReleaseBindingFingerprintPersisted": true, "completeReleaseBindingFingerprintRecomputedBeforeHmac": true, "completeReleaseBindingFingerprintRecomputedBeforeLeaseRenewal": true, "completeReleaseBindingFingerprintRecomputedBeforeActivation": true, "completeReleaseBindingFingerprintIncludesVersionTagAndChronology": true, "completeReleaseBindingFingerprintIsDigitalSignature": false, "downgradeToObserveRequiresExplicitServiceAction": true, "signedReadinessSnapshotRequiredForOperatorDecision": true, "activationEligibilityIsNotActivation": true, "secretsMayAppearInReceipts": false, "rawClientIpMayAppearInReceipts": false }, "claimsBoundary": { "zeroTrustCertificationClaimed": false, "soc2CertificationClaimed": false, "iso27001CertificationClaimed": false, "contractualNetworkSlaClaimed": false, "productionIpFilteringVerified": false, "sourceEvidenceEqualsRuntimeEvidence": false }, "evidence": [ "docs/ENTERPRISE_NETWORK_ACCESS_POLICY_V1.md", "docs/ENTERPRISE_NETWORK_GATEWAY_SECRET_CEREMONY_V1.md", "docs/ENTERPRISE_NETWORK_GATEWAY_EVIDENCE_PACK_V1.md", "docs/ENTERPRISE_NETWORK_GATEWAY_READINESS_V8.md", "docs/ENTERPRISE_NETWORK_GATEWAY_PRE_SIGN_AUTHORITY_V11.md", "docs/ENTERPRISE_NETWORK_GATEWAY_POLICY_FINGERPRINT_V9.md", "docs/ENTERPRISE_NETWORK_GATEWAY_EVIDENCE_SUPERSESSION_V11.md", "docs/ENTERPRISE_NETWORK_GATEWAY_RUNTIME_CONTROL_BINDING_V12.md", "docs/ENTERPRISE_NETWORK_GATEWAY_CLOUDFLARE_RELEASE_BINDING_V13.md", "docs/ENTERPRISE_NETWORK_GATEWAY_PROBE_FRESHNESS_ANCHOR_V14.md", "docs/ENTERPRISE_NETWORK_GATEWAY_RELEASE_LEASE_V15.md", "docs/ENTERPRISE_NETWORK_GATEWAY_RELEASE_CANONICALIZATION_V16.md", "docs/ENTERPRISE_NETWORK_GATEWAY_CANONICAL_LEASE_CONTINUITY_V17.md", "docs/ENTERPRISE_NETWORK_GATEWAY_COMPLETE_RELEASE_BINDING_FINGERPRINT_V18.md", "docs/ENTERPRISE_NETWORK_SOURCE_PRODUCTION_CLAIMS_V1.md", "docs/ENTERPRISE_NETWORK_GATEWAY_RATE_LIMIT_V1.md", "src/lib/enterprise-network-gateway-coverage.ts", "src/lib/enterprise-network-gateway-rate-limit.ts", "src/lib/enterprise-network-gateway-signing-authority.ts", "src/lib/enterprise-network-gateway-cloudflare-binding.ts", "src/lib/enterprise-network-gateway-release-lease.ts", "scripts/check-enterprise-network-gateway-parity.ts", "scripts/check-enterprise-network-claim-separation.ts", "scripts/check-enterprise-network-gateway-activation-v4.ts", "scripts/check-enterprise-network-gateway-evidence-ledger-v6.ts", "scripts/check-enterprise-network-gateway-readiness-v8.ts", "scripts/check-enterprise-network-gateway-pre-sign-v11.ts", "scripts/check-enterprise-network-gateway-policy-fingerprint-v9.ts", "scripts/check-enterprise-network-gateway-evidence-supersession-v11.ts", "scripts/check-enterprise-network-gateway-runtime-control-binding-v12.ts", "scripts/check-enterprise-network-gateway-cloudflare-binding-v13.ts", "scripts/check-enterprise-network-gateway-probe-freshness-v14.ts", "scripts/check-enterprise-network-gateway-release-lease-v15.ts", "scripts/check-enterprise-network-gateway-release-canonicalization-v16.ts", "scripts/check-enterprise-network-gateway-canonical-lease-continuity-v17.ts", "scripts/check-enterprise-network-gateway-complete-release-binding-v18.ts", "scripts/check-enterprise-network-gateway-rate-limit.ts", "scripts/check-supabase-migration-version-uniqueness.ts", "scripts/evaluate-enterprise-network-gateway-cloudflare-binding.ts", "supabase/migrations/20260825207700_agency_privileged_rpc_gateway_v3.sql", "supabase/migrations/20260825207800_agency_network_enforcement_activation_v4.sql", "supabase/migrations/20260825207900_agency_audit_export_gateway_v5.sql", "supabase/migrations/20260825208000_agency_network_gateway_evidence_ledger_v6.sql", "supabase/migrations/20260825208100_agency_network_gateway_evidence_review_gate_v7.sql", "supabase/migrations/20260825208200_agency_network_gateway_readiness_snapshot_v8.sql", "supabase/migrations/20260825208300_agency_network_gateway_pre_sign_authority_v11.sql", "supabase/migrations/20260825208400_agency_network_gateway_rate_limit_v10.sql", "supabase/migrations/20260825208500_agency_network_gateway_policy_fingerprint_v9.sql", "supabase/migrations/20260825208600_agency_network_gateway_evidence_supersession_v11.sql", "supabase/migrations/20260825208700_agency_network_gateway_runtime_control_binding_v12.sql", "supabase/migrations/20260825208800_agency_network_gateway_cloudflare_release_binding_v13.sql", "supabase/migrations/20260825208900_agency_network_gateway_probe_freshness_anchor_v14.sql", "supabase/migrations/20260825209000_agency_network_gateway_release_lease_v15.sql", "supabase/migrations/20260825209100_agency_network_gateway_release_canonicalization_v16.sql", "supabase/migrations/20260825209200_agency_network_gateway_canonical_lease_continuity_v17.sql", "supabase/migrations/20260826070000_agency_network_gateway_complete_release_binding_fingerprint_v18.sql", "src/components/agency/AgencyNetworkGatewayReadinessCard.tsx", "src/components/agency/AgencyNetworkGatewayEvidenceReviewCenter.tsx" ], "disclaimer": { "en": "This manifest describes repository/source controls. Source closure and staged v6-v18 evidence, review, readiness, anti-drift, supersession, runtime-control, actor-bound pre-sign tenant authority, anti-abuse, Cloudflare release binding, oldest-probe freshness anchoring, exact-release lease/revalidation, conservative release canonicalization, pack-scoped readiness, canonical lease continuity and complete-release binding fingerprinting do not prove that migrations, coordinated secrets, canaries, policy-bound reviews, fresh quorum, rate limiting, exact production release binding, release leases, canonicalization, fingerprint verification, revalidation, rollback detection or network enforcement are active in production.", "es": "Este manifiesto describe controles del repositorio/código fuente. El cierre de fuente y los controles staged v6-v18 de evidencia, revisión, readiness, anti-drift, supersession, runtime-control, autoridad tenant pre-sign ligada al actor, anti-abuso, binding de release Cloudflare, anclaje de frescura al probe más antiguo, lease/revalidación del release exacto, canonicalización conservadora, readiness ligado al pack, continuidad canónica del lease y fingerprint del binding completo del release no prueban que las migraciones, secretos coordinados, canaries, revisiones ligadas a la política, quorum fresco, rate limiting, binding del release productivo exacto, leases, canonicalización, verificación de fingerprint, revalidación, detección de rollback o el enforcement de red estén activos en producción." } }