{
  "schema_version": "0.1.0",
  "catalogue_status": "discovery_inventory",
  "authority": "Evidence-derived inventory; not a final implementation-governing SSOT. Preserve source modality and consult conflicts.json.",
  "category": "lifecycle_security_alerts",
  "description": "Status, rotation, suspension, quarantine, freeze, revocation, compromise response, clamps, and alerts.",
  "items": [
    {
      "id": "security.auto_clamps",
      "name": "Automatic clamps",
      "kind": "security_controls",
      "description": "Preventive authorization, replay, freshness, scope, status, enrollment, and history controls.",
      "modality": "source_description",
      "sources": [
        {
          "file": "docs/seed/Clamps_Alerts.txt",
          "lines": "1-21"
        }
      ],
      "controls": [
        "Nonce replay rejection",
        "Tight timestamp windows",
        "Per-Key and per-action rate limits",
        "Maximum active children/depth/lifetime",
        "Resource/namespace and audience restrictions",
        "Required signature combinations",
        "Ancestor status checks and descendant propagation",
        "One-time expiring claims",
        "Component status",
        "Deny precedence",
        "Immutable policy versions and historical signatures"
      ]
    },
    {
      "id": "security.detection",
      "name": "Detection and alerts",
      "kind": "security_controls",
      "description": "Alert candidates for anomalous requests, minting, policy/lifecycle changes, exports, spikes, inactivity, location concurrency, and forbidden endpoints.",
      "modality": "source_description",
      "sources": [
        {
          "file": "docs/seed/Clamps_Alerts.txt",
          "lines": "22-38"
        }
      ]
    },
    {
      "id": "security.manual_clamps",
      "name": "Owner manual clamps",
      "kind": "security_controls",
      "description": "Owner controls over components, Keys, children/subtrees, permissions/ceilings, minting, rotation, tenant freeze, and sessions.",
      "modality": "source_description",
      "sources": [
        {
          "file": "docs/seed/Clamps_Alerts.txt",
          "lines": "39-54"
        }
      ]
    },
    {
      "id": "lifecycle.rotation",
      "name": "Component rotation",
      "kind": "lifecycle_behavior",
      "description": "Component-specific versioning and retained old public keys preserve historical verification; rotation overlap details remain unsettled.",
      "modality": "mvp_inclusion",
      "sources": [
        {
          "file": "docs/seed/MVP_Cut_Line.txt",
          "lines": "18-20"
        },
        {
          "file": "docs/seed/Minimum_Database_Model.txt",
          "lines": "46-60"
        }
      ]
    },
    {
      "id": "lifecycle.compromise",
      "name": "Compromise reporting",
      "kind": "lifecycle_behavior",
      "description": "Dedicated narrowly scoped compromise-report challenge is proposed; compromised Key must never resume itself.",
      "modality": "firm_statement",
      "sources": [
        {
          "file": "docs/seed/Permissions_Catalogue.txt",
          "lines": "193-195"
        }
      ]
    },
    {
      "id": "lifecycle.ancestor_effects",
      "name": "Ancestor lifecycle propagation",
      "kind": "lifecycle_behavior",
      "description": "Suspension temporarily suspends descendants; revocation prevents new descendant actions immediately without rewriting provenance.",
      "modality": "explicit_immutable",
      "sources": [
        {
          "file": "docs/seed/Authorization_Invariants.txt",
          "lines": "14-17"
        }
      ]
    }
  ]
}