{
  "schema_version": "0.1.0",
  "catalogue_status": "discovery_inventory",
  "authority": "Evidence-derived inventory; not a final implementation-governing SSOT. Preserve source modality and consult conflicts.json.",
  "category": "conflicts_open_questions",
  "description": "Competing source descriptions and decisions intentionally left unresolved.",
  "items": [
    {
      "id": "conflict.php_version",
      "name": "PHP runtime constraint",
      "kind": "conflict",
      "description": "Composition lists php ^8.2; earlier possible dependencies list php ^8.5.",
      "modality": "conflict",
      "sources": [
        {
          "file": "docs/seed/Composition_Dependencies.txt",
          "lines": "21-23"
        },
        {
          "file": "docs/seed/Description_Zero.txt",
          "lines": "61-63"
        }
      ],
      "decision_needed": "Select supported PHP version only in later architecture decision pass."
    },
    {
      "id": "conflict.owner_session",
      "name": "Owner session mechanism",
      "kind": "conflict",
      "description": "Console surface says owner JWT while Sessions firmly specifies opaque hashed PostgreSQL tokens and rejects stateless JWT sessions.",
      "modality": "conflict",
      "sources": [
        {
          "file": "docs/seed/Composition_Dependencies.txt",
          "lines": "44"
        },
        {
          "file": "docs/seed/Sessions.txt",
          "lines": "1-3"
        }
      ]
    },
    {
      "id": "conflict.key_auth",
      "name": "Key authentication mechanism",
      "kind": "conflict",
      "description": "Gateway says key JWT + device header + use-key constraints, whereas Key Execution Plane and request-format sources describe fixed signed requests and reject bearer Credential ID.",
      "modality": "conflict",
      "sources": [
        {
          "file": "docs/seed/Composition_Dependencies.txt",
          "lines": "43"
        },
        {
          "file": "docs/seed/Description.txt",
          "lines": "24-34"
        },
        {
          "file": "docs/seed/API_Request_Format.txt",
          "lines": "1-44"
        }
      ]
    },
    {
      "id": "conflict.surfaces",
      "name": "Surface taxonomy",
      "kind": "conflict",
      "description": "Public/gateway/console route grouping overlaps but is not explicitly mapped to Owner Control Plane/Key Execution Plane.",
      "modality": "conflict",
      "sources": [
        {
          "file": "docs/seed/Composition_Dependencies.txt",
          "lines": "40-44"
        },
        {
          "file": "docs/seed/Description.txt",
          "lines": "1-34"
        }
      ]
    },
    {
      "id": "conflict.bundle_names",
      "name": "Credential component aliases",
      "kind": "conflict",
      "description": "Legacy assertion/access/control field names are not explicitly mapped to Authentication/Authorship/Confidentiality purpose names.",
      "modality": "conflict",
      "sources": [
        {
          "file": "docs/seed/Description.txt",
          "lines": "55-65"
        },
        {
          "file": "docs/seed/Credential_Payload.txt",
          "lines": "1-163"
        }
      ]
    },
    {
      "id": "conflict.jwt_package",
      "name": "firebase/php-jwt necessity",
      "kind": "open_question",
      "description": "Package is listed, but Owner JWTs conflict with session rules and Key JWTs conflict with signed requests; package role/necessity is unsettled.",
      "modality": "open_question",
      "sources": [
        {
          "file": "docs/seed/Composition_Dependencies.txt",
          "lines": "26"
        },
        {
          "file": "docs/seed/Composition_Dependencies.txt",
          "lines": "43-44"
        },
        {
          "file": "docs/seed/Sessions.txt",
          "lines": "3"
        }
      ]
    },
    {
      "id": "conflict.cache_rate",
      "name": "Symfony cache/rate-limiter and Redis exclusion",
      "kind": "open_question",
      "description": "Symfony cache/rate-limiter are listed while Redis/distributed nonce caching is deferred; adapters/storage and necessity are unspecified.",
      "modality": "open_question",
      "sources": [
        {
          "file": "docs/seed/Composition_Dependencies.txt",
          "lines": "34-35"
        },
        {
          "file": "docs/seed/MVP_Cut_Line.txt",
          "lines": "42-44"
        }
      ]
    },
    {
      "id": "conflict.protocol_gaps",
      "name": "Request normalization and limits",
      "kind": "open_question",
      "description": "Normalized path/query, byte encodings, timestamp window, nonce size/encoding details, errors, and concurrency semantics are not fully specified.",
      "modality": "open_question",
      "sources": [
        {
          "file": "docs/seed/API_Request_Format.txt",
          "lines": "5-46"
        }
      ]
    },
    {
      "id": "conflict.lifecycle_gaps",
      "name": "Lifecycle state machine",
      "kind": "open_question",
      "description": "Statuses, overlap/grace intervals, transition authorization, retention, and transaction boundaries are incomplete.",
      "modality": "open_question",
      "sources": [
        {
          "file": "docs/seed/Minimum_Database_Model.txt",
          "lines": "28-60"
        },
        {
          "file": "docs/seed/Considerations.txt",
          "lines": "17-19"
        }
      ]
    },
    {
      "id": "conflict.dependencies",
      "name": "Unexplained package roles",
      "kind": "open_question",
      "description": "Guzzle, CORS, validation, dotenv, Monolog, cache/rate limiter and other packages are listed without source-stated capability mapping or final status.",
      "modality": "open_question",
      "sources": [
        {
          "file": "docs/seed/Composition_Dependencies.txt",
          "lines": "21-35"
        }
      ]
    },
    {
      "id": "conflict.five_device_evidence",
      "name": "Device/network assurance evidence",
      "kind": "open_question",
      "description": "Distinct destinations/clients/networks are recorded evidence only; IP addresses cannot prove physical separation.",
      "modality": "firm_statement",
      "sources": [
        {
          "file": "docs/seed/Five_Device_Instantiation.txt",
          "lines": "92-109"
        }
      ]
    }
  ]
}