{
  "schema": "kingdom.karma-mirror-rules/v1",
  "practice": "KARMA MIRROR — reflect the behavior, never target the being",
  "scenario_schema": "kingdom.karma-mirror/v1",
  "decision_schema": "kingdom.karma-mirror-decision/v1",
  "rules": [
    {
      "behavior": "credential-stuffing",
      "purpose": "account-access-at-scale",
      "boundary_signal": "repeated-auth-failure",
      "family": "authentication-abuse",
      "disposition": "contain",
      "response": "progressive-auth-backoff-review",
      "reflection": "repetition-becomes-bounded-auth-friction",
      "detection_candidate": "auth-failure-pattern-candidate",
      "regression_candidate": "credential-rotation-regression-candidate",
      "repair_candidate": "auth-backoff-repair-candidate"
    },
    {
      "behavior": "reconnaissance",
      "purpose": "surface-discovery",
      "boundary_signal": "forbidden-route-enumeration",
      "family": "surface-enumeration",
      "disposition": "mirror",
      "response": "synthetic-surface-review",
      "reflection": "enumeration-becomes-synthetic-only-exploration",
      "detection_candidate": "forbidden-route-observation-candidate",
      "regression_candidate": "route-enumeration-regression-candidate",
      "repair_candidate": "surface-minimization-repair-candidate"
    },
    {
      "behavior": "injection-attempt",
      "purpose": "interpreter-control",
      "boundary_signal": "syntax-boundary-probe",
      "family": "interpreter-boundary",
      "disposition": "quarantine",
      "response": "parser-reject-egress-deny-review",
      "reflection": "control-attempt-becomes-parser-regression",
      "detection_candidate": "syntax-boundary-observation-candidate",
      "regression_candidate": "parser-boundary-regression-candidate",
      "repair_candidate": "strict-parser-repair-candidate"
    },
    {
      "behavior": "resource-abuse",
      "purpose": "capacity-exhaustion",
      "boundary_signal": "repeated-expensive-operation",
      "family": "capacity-abuse",
      "disposition": "contain",
      "response": "bounded-work-queue-review",
      "reflection": "amplification-becomes-one-bounded-work-unit",
      "detection_candidate": "quota-pressure-observation-candidate",
      "regression_candidate": "work-budget-regression-candidate",
      "repair_candidate": "bounded-queue-repair-candidate"
    },
    {
      "behavior": "exfiltration-attempt",
      "purpose": "data-removal",
      "boundary_signal": "protected-data-boundary-read",
      "family": "data-boundary",
      "disposition": "quarantine",
      "response": "data-boundary-egress-deny-review",
      "reflection": "protected-access-becomes-data-boundary-regression",
      "detection_candidate": "data-boundary-observation-candidate",
      "regression_candidate": "egress-denial-regression-candidate",
      "repair_candidate": "data-boundary-repair-candidate"
    },
    {
      "behavior": "prompt-injection",
      "purpose": "authority-escalation",
      "boundary_signal": "instruction-boundary-override",
      "family": "agent-boundary",
      "disposition": "quarantine",
      "response": "tainted-context-no-tools-review",
      "reflection": "override-attempt-becomes-context-boundary-test",
      "detection_candidate": "instruction-boundary-observation-candidate",
      "regression_candidate": "tool-denial-regression-candidate",
      "repair_candidate": "context-separation-repair-candidate"
    },
    {
      "behavior": "unresolved-observation",
      "purpose": "unresolved",
      "boundary_signal": "ambiguous-request-shape",
      "family": "unknown",
      "disposition": "observe",
      "response": "observe-only",
      "reflection": "ambiguity-remains-ambiguity",
      "detection_candidate": "human-observation-candidate",
      "regression_candidate": "benign-near-miss-regression-candidate",
      "repair_candidate": "classifier-boundary-review-candidate"
    }
  ],
  "contract": {
    "assessment_unit": "declared-behavior",
    "behavior_is_authored_not_detected": true,
    "purpose_is_authored_not_inferred": true,
    "classifies_people": false,
    "owned_or_authorized_boundary_required": true,
    "identity_fields_allowed": false,
    "payload_fields_allowed": false,
    "free_text_fields_allowed": false,
    "scores_or_ranks": false,
    "aggregation_allowed": false,
    "tracks_repetition": false,
    "automatic_blocking": false,
    "retaliation": false,
    "hack_back": false,
    "executes_input": false,
    "executes_response": false,
    "human_review_required_for_action": true,
    "rights_and_debts_unchanged": true,
    "creates_external_effect": false
  },
  "budget": {
    "declarations": 1,
    "passes": 1,
    "file_bytes_max": 32768,
    "decoded_nodes_max": 256,
    "nesting_depth_max": 8,
    "string_characters_max": 512,
    "automatic_retries": 0,
    "network_calls": 0,
    "external_messages": 0,
    "writes": 0,
    "subprocesses": 0,
    "model_calls": 0,
    "paid_calls": 0,
    "payload_bytes_retained": 0
  },
  "breach": {
    "state": "quarantined",
    "action": "stop-without-retry-or-result",
    "source_unchanged": true,
    "submitted_values_echoed": false,
    "downstream_effects": false
  },
  "non_claims": [
    "The declaration names a behavior shape, never a person, identity, intention, guilt, character, or worth.",
    "The engine does not detect an attack or establish truth, exploitability, success, safety, legality, consent, or authority.",
    "Behavior, purpose, disposition, and response are closed categories, never confidence, severity, score, rank, or reputation.",
    "A response is local advisory structure for human review, never blocking, retaliation, hack-back, execution, deployment, or authority.",
    "No raw payload, address, credential, target, callback, command, or free text is accepted, retained, rendered, or echoed.",
    "Digests prove reviewed canonical JSON content relationships and deterministic recomputation only."
  ]
}