{
  "contract_pack_version": "0.1.0",
  "service_authentication": {
    "caller_binding": "registered caller, operation scope, and tenant allowlist",
    "header": "Authorization",
    "identity_source": "deployment-managed opaque service token",
    "replay": "Service-token replay protection is owned by the deployment boundary.",
    "rotation": "Provision a replacement token, verify it, then revoke the old token.",
    "scheme": "Bearer"
  },
  "tenant_credential": {
    "forbidden_surfaces": [
      "database",
      "queue",
      "cache",
      "checkpoint",
      "logs",
      "traces",
      "events",
      "browser"
    ],
    "header": "X-Tenant-VKey",
    "owner": "caller and AIHub",
    "persistence": "in-memory execution attempt only"
  },
  "webhook_authentication": {
    "algorithm": "HMAC-SHA256",
    "headers": [
      "X-DotB-Webhook-Id",
      "X-DotB-Webhook-Key-Id",
      "X-DotB-Webhook-Timestamp",
      "X-DotB-Webhook-Signature"
    ],
    "rotation": "Receiver may accept active and immediately previous key during a bounded window."
  }
}