{
  "schema_version": "qazpolit.agent-security-boundary.v1",
  "service": "qazpolit",
  "status": "offline_review_contract",
  "public_runtime_scanner": false,
  "automatic_remediation": false,
  "automatic_disclosure": false,
  "production_credentials_allowed": false,
  "synthetic_fixture_only": true,
  "threats": [
    {"class": "spoofing", "control": "Use synthetic identities and assert that no fixture can create or restore a QazPolit persona."},
    {"class": "tampering", "control": "Pin fixture hashes and fail when an action, source receipt or expected result changes."},
    {"class": "repudiation", "control": "Retain request IDs, tool inputs, bounded outputs and reviewer decisions."},
    {"class": "information_disclosure", "control": "Allow public fixtures only; reject secrets, admin routes, unpublished records and private analytics."},
    {"class": "denial_of_service", "control": "Apply hard request, token, time and result budgets with no background retry loop."},
    {"class": "elevation_of_privilege", "control": "Expose no mutation, shell, merge, publish, correction or credential-bearing action."},
    {"class": "prompt_injection", "control": "Treat retrieved text as untrusted evidence content, never as executable instruction."},
    {"class": "false_positive", "control": "Require a human reviewer before remediation, disclosure, merge or publication."}
  ],
  "acceptance_evidence": [
    "checked_in_synthetic_fixture",
    "pinned_tool_and_model_versions",
    "manual_stride_comparison",
    "false_positive_review",
    "zero_secret_scan_of_fixture",
    "bounded_cost_and_runtime_report"
  ],
  "promotion_gate": "A separate security review must approve the exact pinned tool and fixture. This contract never authorizes production scanning or changes."
}