Skip to content

Alliance Policy v1

Source schema: doc/schemas/alliance-policy.v1.schema.json

Unilateral cross-federation alliance declaration. A cooperation relationship is operationally active only when all member federations hold fresh matching halves; the effective scope is the intersection of allowed_scopes minus any denied_scopes. Member root digests are evidence only, not validity pins. Runtime verification must re-check issuer and member subjects against active federation roots before use.

Governing Basis

Project Lineage

Requirements

Stories

Fixtures

Valid Fixtures

Invalid Fixtures

Fields

Field Required Shape Description
schema yes const: alliance-policy.v1 Schema discriminator. MUST be exactly alliance-policy.v1.
alliance_id yes string Deterministic alliance id derived from the sorted member federation ids and the alliance-policy v1 domain label.
issuer_federation_id yes string Federation that authored this unilateral policy half. Whitespace is forbidden so deterministic alliance id derivation and issuer/member matching remain unambiguous. MUST be one of members[].federation_id; runtime enforces the cross-field invariant.
issuer_subject_ref yes ref: #/$defs/SovereignSubjectRef Sovereign subject in the issuer federation's active root whose custody policy authorizes this declaration. Runtime MUST verify that this subject matches the members[] entry for issuer_federation_id.
sequence_no yes integer Monotonic sequence number per (issuer_federation_id, alliance_id). Older sequence numbers are rollback candidates.
members yes array Federations participating in the alliance. Runtime treats the member set as unordered and requires every active half to name the same set.
allowed_scopes yes array Scopes this issuer allows. Active alliance scope is the intersection across all matching halves.
denied_scopes no array Scopes this issuer explicitly denies. Deny overrides allow across all matching halves.
publication yes ref: #/$defs/Publication Where this policy half may be stored or advertised. Publication surface never substitutes for signature/root verification.
issued_at yes string RFC 3339 issuance timestamp. Diagnostic and replay context; sequence/expiry/revocation govern replacement.
expires_at yes string RFC 3339 expiry timestamp. Verifiers MUST reject the half at or after this time. Runtime MUST also enforce expires_at > issued_at because portable JSON Schema does not support cross-field date comparison.
policy_ref no string Optional local or governance policy reference explaining why this declaration was authorized.
revocation_ref no string Optional revocation feed or local revocation view reference. Runtime profile decides how it is resolved.
signatures yes array One or more Ed25519 signatures over the canonical payload with signatures omitted. uniqueItems rejects exact duplicate signature objects; runtime still enforces issuer subject custody semantics and unique signing keys.

Definitions

Definition Shape Description
SovereignSubjectRef string
Sha256Digest string
Member object
AllianceScope enum: room/cross-federation, whisper/cross-federation, corpus/cross-federation, artifact-delivery/cross-federation, inac/cross-federation, agora/topic-bridge Closed v1 scope registry. Unknown scopes fail closed.
Publication object
Signature object
## Field Semantics

schema

  • Required: yes
  • Shape: const: alliance-policy.v1

Schema discriminator. MUST be exactly alliance-policy.v1.

alliance_id

  • Required: yes
  • Shape: string

Deterministic alliance id derived from the sorted member federation ids and the alliance-policy v1 domain label.

issuer_federation_id

  • Required: yes
  • Shape: string

Federation that authored this unilateral policy half. Whitespace is forbidden so deterministic alliance id derivation and issuer/member matching remain unambiguous. MUST be one of members[].federation_id; runtime enforces the cross-field invariant.

issuer_subject_ref

  • Required: yes
  • Shape: ref: #/$defs/SovereignSubjectRef

Sovereign subject in the issuer federation's active root whose custody policy authorizes this declaration. Runtime MUST verify that this subject matches the members[] entry for issuer_federation_id.

sequence_no

  • Required: yes
  • Shape: integer

Monotonic sequence number per (issuer_federation_id, alliance_id). Older sequence numbers are rollback candidates.

members

  • Required: yes
  • Shape: array

Federations participating in the alliance. Runtime treats the member set as unordered and requires every active half to name the same set.

allowed_scopes

  • Required: yes
  • Shape: array

Scopes this issuer allows. Active alliance scope is the intersection across all matching halves.

denied_scopes

  • Required: no
  • Shape: array

Scopes this issuer explicitly denies. Deny overrides allow across all matching halves.

publication

  • Required: yes
  • Shape: ref: #/$defs/Publication

Where this policy half may be stored or advertised. Publication surface never substitutes for signature/root verification.

issued_at

  • Required: yes
  • Shape: string

RFC 3339 issuance timestamp. Diagnostic and replay context; sequence/expiry/revocation govern replacement.

expires_at

  • Required: yes
  • Shape: string

RFC 3339 expiry timestamp. Verifiers MUST reject the half at or after this time. Runtime MUST also enforce expires_at > issued_at because portable JSON Schema does not support cross-field date comparison.

policy_ref

  • Required: no
  • Shape: string

Optional local or governance policy reference explaining why this declaration was authorized.

revocation_ref

  • Required: no
  • Shape: string

Optional revocation feed or local revocation view reference. Runtime profile decides how it is resolved.

signatures

  • Required: yes
  • Shape: array

One or more Ed25519 signatures over the canonical payload with signatures omitted. uniqueItems rejects exact duplicate signature objects; runtime still enforces issuer subject custody semantics and unique signing keys.

Definition Semantics

$defs.SovereignSubjectRef

  • Shape: string

$defs.Sha256Digest

  • Shape: string

$defs.Member

  • Shape: object

$defs.AllianceScope

  • Shape: enum: room/cross-federation, whisper/cross-federation, corpus/cross-federation, artifact-delivery/cross-federation, inac/cross-federation, agora/topic-bridge

Closed v1 scope registry. Unknown scopes fail closed.

$defs.Publication

  • Shape: object

$defs.Signature

  • Shape: object