{:kotoba.crypto-boundaries/version 1
 :kotoba.crypto-boundaries/policy
 {:new-boundary-floor :post-quantum
  :classical-only :reject
  :unknown-suite :reject
  :missing-pq-material :reject
  :legacy-development-compatibility-required false
  :required-boundary-ids
  #{:cli/hybrid-envelope
    :package/publication-attestation
    :cloud/hosted-publication
    :cloud/pq-key-lifecycle
    :storage/private-content
    :compute/decryption-grant
    :external/webauthn-authenticator
    :external/tls-transport
    :external/ipns-record}}
 :kotoba.crypto-boundaries/boundaries
 [{:boundary/id :cli/hybrid-envelope
   :boundary/owner "kotoba-lang/kotoba"
   :boundary/kind :confidentiality
   :boundary/classification :managed
   :boundary/admission :admitted
   :boundary/pq-required true
   :boundary/suite :x25519+ml-kem-768+aes-256-gcm
   :boundary/downgrade :reject
   :boundary/implementation ["src/kotoba/hybrid_envelope.clj"]
   :boundary/tests ["test/kotoba/hybrid_envelope_test.clj"
                    "test/kotoba/codebase_cli_test.clj"]}

  {:boundary/id :package/publication-attestation
   :boundary/owner "kotoba-lang/kotoba"
   :boundary/kind :signature
   :boundary/classification :managed
   :boundary/admission :admitted
   :boundary/pq-required true
   :boundary/suite :ed25519+ml-dsa-65
   :boundary/downgrade :reject
   :boundary/implementation ["src/kotoba/package_pqc.clj"
                             "src/kotoba/package_install.clj"]
   :boundary/tests ["test/kotoba/package_install_test.clj"
                    "test/kotoba/package_admission_test.clj"]}

  {:boundary/id :cloud/hosted-publication
   :boundary/owner "kotoba-lang/app-kotoba-cloud"
   :boundary/kind :authorization-signature
   :boundary/classification :managed
   :boundary/admission :admitted
   :boundary/pq-required true
   :boundary/suite :passkey+ml-dsa-65
   :boundary/downgrade :reject
   :boundary/implementation ["src/app_kotoba_cloud/worker.cljs"
                             "src/app_kotoba_cloud/pqc.cljs"]
   :boundary/tests ["test/worker-smoke.mjs"]}

  {:boundary/id :cloud/pq-key-lifecycle
   :boundary/owner "kotoba-lang/app-kotoba-cloud"
   :boundary/kind :key-management
   :boundary/classification :managed
   :boundary/admission :admitted
   :boundary/pq-required true
   :boundary/suite :passkey+ml-dsa-65
   :boundary/downgrade :reject
   :boundary/enforcement :fail-closed
   :boundary/implementation ["src/app_kotoba_cloud/worker.cljs"
                             "src/app_kotoba_cloud/pq_key_lifecycle.cljc"
                             "src/app_kotoba_cloud/pq_key_registry.cljs"
                             "src/app_kotoba_cloud/browser.cljs"]
   :boundary/tests ["test/app_kotoba_cloud/pq_key_lifecycle_test.cljc"
                    "test/worker-smoke.mjs"]
   :boundary/endpoints ["https://kotoba.cloud/v1/pq-keys/rotate"
                        "https://kotoba.cloud/v1/pq-keys/revoke"]
   :boundary/residual-gaps [:independent-recovery-quorum
                            :scheduled-rotation-drill
                            :public-transparency-witness]
   :boundary/note "Enrollment, monotonic epochs, exact-request replay rejection, current+next-key rotation, current-key revocation, and Passkey-authenticated public transitions are live. Recovery without the current key, scheduled drills, and an external transparency witness remain outside this admitted normal-lifecycle slice."}

  {:boundary/id :storage/private-content
   :boundary/owner "net-kotobase/control-plane"
   :boundary/kind :confidentiality
   :boundary/classification :managed
   :boundary/admission :blocked
   :boundary/pq-required true
   :boundary/downgrade :reject
   :boundary/enforcement :fail-closed
   :boundary/gaps [:hybrid-envelope-required-before-storage
                   :epoch-dek-grants
                   :cryptographic-erasure-receipt]}

  {:boundary/id :compute/decryption-grant
   :boundary/owner "network-awai/cloud-murakumo"
   :boundary/kind :confidentiality
   :boundary/classification :managed
   :boundary/admission :blocked
   :boundary/pq-required true
   :boundary/downgrade :reject
   :boundary/enforcement :fail-closed
   :boundary/gaps [:short-lived-decryption-grant
                   :plaintext-lifetime-proof
                   :revocation-propagation]}

  {:boundary/id :external/webauthn-authenticator
   :boundary/owner "external/webauthn"
   :boundary/kind :authentication
   :boundary/classification :external
   :boundary/admission :external
   :boundary/pq-required false
   :boundary/limitation "Authenticator-selected WebAuthn COSE algorithms are separately qualified and are not claimed post-quantum."}

  {:boundary/id :external/tls-transport
   :boundary/owner "external/tls"
   :boundary/kind :transport
   :boundary/classification :external
   :boundary/admission :external
   :boundary/pq-required false
   :boundary/limitation "Public TLS termination is measured separately; application-layer PQ admission does not make it post-quantum."}

  {:boundary/id :external/ipns-record
   :boundary/owner "external/ipns"
   :boundary/kind :mutable-name-signature
   :boundary/classification :external
   :boundary/admission :external
   :boundary/pq-required false
   :boundary/limitation "The legacy IPNS signature remains classical; Kotoba requires a separate Principal-pinned ML-DSA approval before relay."}]}