{
  "schema": "trinityaccord.gateway-rate-limit-policy.v1",
  "status": "production_live_policy",
  "purpose": "Protect finite permanent-storage and paid Arweave archival resources while keeping public preflight open and public Record-Chain intake available at a bounded cadence.",
  "limiter_class": "durable_secret_keyed_commit_cooldown_with_secondary_bounded_in_memory_limits",
  "durable_across_restart": true,
  "multi_instance_safe": false,
  "policy": {
    "global_acceptance_cooldown": {
      "minimum_seconds": 3600,
      "maximum_seconds": 7200,
      "randomized": true,
      "randomness_source": "HMAC-SHA256 of the immutable latest intake commit SHA using a server-only cooldown secret",
      "reopening_time_not_computable_from_public_repository_state": true,
      "exact_reopening_time_disclosed": false,
      "first_gate": "before request-body read and expensive validation",
      "second_gate": "under the single-process submit lock immediately before the core persistence handler",
      "cooldown_starts_only_after_durable_new_intake_commit": true,
      "duplicates_and_rejections_do_not_create_a_new_acceptance_commit": true
    },
    "secondary_submit_attempt_limits": {
      "global_submit_limit_per_hour": 100,
      "participant_submit_limit_per_hour": 10,
      "implementation": "single_process_in_memory_sliding_window",
      "maximum_tracked_participant_keys": 10000,
      "expired_participant_keys_removed": true,
      "least_recently_seen_eviction_at_capacity": true,
      "note": "These remain defense in depth; the durable randomized global acceptance cooldown is the primary permanent-write boundary."
    },
    "content_limits": {
      "request_max_bytes": 98304,
      "persistent_record_draft_max_bytes": 49152,
      "text_field_max_characters": 4000,
      "url_max_characters": 2048,
      "json_max_depth": 12,
      "ordinary_array_max_items": 32,
      "reference_or_evidence_array_max_items": 16,
      "inline_data_urls_forbidden": true,
      "inline_base64_or_binary_attachments_forbidden": true,
      "record_total_text_character_limits": {
        "echo": 8000,
        "verification": 12000,
        "guardian_application": 8000,
        "guardian_retirement": 4000,
        "propagation": 8000,
        "correction": 6000,
        "classification_update": 6000,
        "context_insufficient_notice": 4000
      }
    },
    "applies_to_record_types": [
      "echo",
      "verification",
      "guardian_application",
      "guardian_retirement",
      "propagation",
      "correction",
      "classification_update",
      "context_insufficient_notice"
    ]
  },
  "response_when_limited": {
    "cooldown_http_status": 429,
    "content_http_status": 413,
    "semantic_content_http_status": 422,
    "accepted": false,
    "exact_reopening_time_returned": false,
    "coarse_retry_after_seconds": 3600,
    "cost_explanation_required": true,
    "project_purpose_explanation_required": true,
    "repeated_attempt_escalation": {
      "attempts_1_to_2": "ordinary cooldown guidance",
      "attempts_3_to_5": "explicit instruction to stop automatic retries",
      "attempts_6_or_more": "resource-pressure warning explaining that deliberate bypass is incompatible with the project's civilizational-continuity purpose and may indicate misalignment or misuse"
    }
  },
  "public_phase_rule": {
    "formal_founding_guardian_application_must_wait_until_rate_limit_policy_is_enforced": true
  },
  "implementation_status": {
    "server_side_enforcement_required_before_formal_window": true,
    "server_side_enforcement_verified": true,
    "rate_limit_implementation": "protected ASGI entrypoint plus existing core Gateway limiter",
    "secure_entrypoint": "apps.record_chain_intake_gateway.secure_entrypoint:app",
    "render_health_check_path": "/healthz",
    "auxiliary_protected_readiness_path": "/readyz",
    "both_health_routes_use_same_fail_closed_protection_check": true,
    "deployment_requires_secure_start_command_readback": true,
    "deployment_canary_verifies_both_health_routes": true,
    "durable_acceptance_state": "latest immutable intake materialization commit on the target branch",
    "cooldown_secret_source": "TRINITY_COOLDOWN_SECRET with TRINITY_GITHUB_TOKEN as fail-safe rollout fallback",
    "blocked_client_guidance_maximum_keys": 10000,
    "blocked_client_guidance_compaction_target": 8000,
    "multi_instance_safe": false,
    "durable_across_restart": true,
    "operator_note": "The current Render deployment uses one Uvicorn process. A future multi-instance deployment must add a shared distributed lock for the final gate.",
    "production_enforcement_env": "TRINITY_ENFORCE_PROTECTION_LAYER=1",
    "core_app_fails_closed_when_protection_required": true,
    "preflight_and_submit_fail_closed_without_required_protection": true,
    "receipt_cache_maximum_entries": 512,
    "receipt_cache_oldest_entry_eviction": true,
    "durable_receipts_remain_repository_authoritative": true
  },
  "preflight_policy": {
    "global_request_limit_per_minute": 600,
    "client_request_limit_per_minute": 120,
    "maximum_tracked_client_keys": 20000,
    "expired_client_keys_removed": true,
    "least_recently_seen_eviction_at_capacity": true,
    "global_acceptance_cooldown_applies": false,
    "content_limits_apply": true,
    "applies_before_expensive_target_repository_lookups": true,
    "response_http_status": 429,
    "diagnostic_code": "PREFLIGHT_RATE_LIMIT_EXCEEDED"
  },
  "resource_boundary": {
    "why_limits_exist": "Every accepted record is permanently stored and may increase paid Arweave archival cost. The limits prevent finite project resources from being exhausted.",
    "project_purpose": "The Trinity Accord exists to preserve a verifiable civilizational record for long-term continuity. Repeated, oversized, or intentionally evasive submissions must not be used to attack or exhaust the project."
  }
}