{
  "format": "vercy-world-model-candidate/v1",
  "contourId": "EM-TEC-03",
  "modelId": "WM-SFT-003",
  "registryId": "vr.wm-sft-003",
  "name": "API / Interface Contract",
  "version": "0.1.0-candidate.2",
  "entryKind": "contract-aggregate",
  "status": "research-candidate",
  "canonicalPublishable": false,
  "purpose": "Represent a stable interface-contract family with immutable revisions, exact consumer pins, compatibility evidence and effective-dated exposure without owning payload, endpoint, Integration or exchange identity.",
  "boundary": {
    "owns": [
      "interface-contract family identity",
      "immutable contract revisions and declared interface surface",
      "exact consumer pins and reproducible resolution records",
      "compatibility assessments and bounded exceptions",
      "family- or revision-level exposure to endpoint and environment"
    ],
    "delegates": [
      "payload semantics to WM-DAT-004",
      "endpoint and address lifecycle to WM-SFT-018",
      "addressed occurrences to WM-REC-003",
      "other occurrences to WM-ACT-015"
    ],
    "excludes": [
      "Integration and ConsumptionRouting pending allocation",
      "ExchangeEvent",
      "payload mastership",
      "endpoint identity",
      "occurrence lifecycle",
      "observed latency freshness delivery or availability",
      "credentials secrets tokens private keys and auth material",
      "automatic identity from URLs revisions probes tests or calls"
    ]
  },
  "temporal": {
    "interval": "half-open [from,to)",
    "timeBasis": "UTC millisecond precision",
    "openEnd": "null to",
    "recordTime": "recordedAt is append-only; corrections use supersedesLocalHandle"
  },
  "objects": {
    "InterfaceContract": {
      "naturalKey": [
        "contractId"
      ],
      "required": [
        "contractId",
        "name",
        "purpose",
        "ownerRef",
        "providerRole",
        "consumerScope",
        "status"
      ],
      "optional": [
        "supersedesContractId"
      ],
      "lifecycle": [
        "draft",
        "active",
        "deprecated",
        "retired"
      ]
    },
    "ContractRevision": {
      "naturalKey": [
        "contractId",
        "revision"
      ],
      "required": [
        "contractId",
        "revision",
        "publishedAt",
        "compatibilityMode",
        "interactionStyle",
        "operationSet",
        "parameterSet",
        "errorVocabulary",
        "declaredAuthScheme",
        "declaredDeliverySemantics",
        "declaredFreshnessTarget",
        "contentDigest",
        "status"
      ],
      "optional": [
        "channelSet",
        "schemaRefs",
        "supersedesRevision",
        "successorRef",
        "sunsetAt"
      ],
      "lifecycle": [
        "draft",
        "published",
        "deprecated",
        "retired"
      ]
    },
    "ConsumerPin": {
      "naturalKey": [
        "consumerRef",
        "contractId",
        "revision",
        "scopeRef",
        "effectiveFrom"
      ],
      "required": [
        "consumerRef",
        "contractId",
        "revision",
        "scopeRef",
        "effectiveFrom",
        "authorityRef",
        "recordedAt",
        "status"
      ],
      "optional": [
        "environmentRef",
        "effectiveTo",
        "migrationTargetRef",
        "localHandle",
        "supersedesLocalHandle"
      ],
      "lifecycle": [
        "proposed",
        "effective",
        "superseded",
        "withdrawn"
      ]
    },
    "RevisionResolutionRecord": {
      "naturalKey": [
        "consumerRef",
        "contractId",
        "resolvedAt"
      ],
      "required": [
        "consumerRef",
        "contractId",
        "requestedSelector",
        "resolvedRevision",
        "resolvedAt",
        "evidenceRef",
        "recordedAt"
      ],
      "optional": [
        "localHandle"
      ]
    },
    "RevisionExposure": {
      "naturalKey": [
        "contractTargetKind",
        "contractTargetRef",
        "endpointRef",
        "environmentRef",
        "validFrom"
      ],
      "required": [
        "contractTargetKind",
        "contractTargetRef",
        "endpointRef",
        "environmentRef",
        "protocol",
        "mediaType",
        "validFrom",
        "authorityRef",
        "recordedAt",
        "status"
      ],
      "optional": [
        "validTo",
        "contentEncoding",
        "policyRef",
        "scopeRef",
        "purpose",
        "localHandle",
        "supersedesLocalHandle"
      ],
      "lifecycle": [
        "proposed",
        "effective",
        "superseded",
        "withdrawn"
      ]
    },
    "CompatibilityAssessment": {
      "naturalKey": [
        "contractId",
        "candidateRevision",
        "baselineRange",
        "assessedAt"
      ],
      "required": [
        "contractId",
        "candidateRevision",
        "baselineRange",
        "declaredMode",
        "checks",
        "result",
        "evidenceRefs",
        "assessedAt",
        "authorityRef",
        "recordedAt"
      ],
      "optional": [
        "exceptionRef",
        "exceptionExpiresAt",
        "exceptionAuthorityRef",
        "exceptionRationale",
        "impactAnalysisRef",
        "noticeRequirements",
        "localHandle"
      ]
    }
  },
  "schemaCardinality": "0..n immutable WM-DAT-004 revisions per contract revision; at least one for payload-bearing operations",
  "relations": [
    {
      "target": "WM-DAT-004",
      "relation": "REFERENCE",
      "required": false,
      "purpose": "ContractRevision schemaRefs cite immutable payload revisions."
    },
    {
      "target": "WM-SFT-018",
      "relation": "REFERENCE",
      "required": false,
      "purpose": "RevisionExposure cites one endpoint; no endpoint data is copied."
    }
  ],
  "incomingRelations": [
    {
      "source": "WM-REC-003",
      "relation": "REFERENCE",
      "navigable": false,
      "cardinality": "0..n",
      "purpose": "Messages cite one revision and exposure; WM-SFT-003 does not enumerate them."
    },
    {
      "source": "WM-ACT-015",
      "relation": "REFERENCE",
      "navigable": false,
      "cardinality": "0..n",
      "purpose": "Other occurrences cite one revision and exposure; WM-SFT-003 does not enumerate them."
    }
  ],
  "invariants": [
    {
      "id": "INV-SFT003-01",
      "rule": "InterfaceContract is a stable family root; published ContractRevision children are immutable and content-addressed."
    },
    {
      "id": "INV-SFT003-02",
      "rule": "A revision reaches published only under an active contract; retiring a contract requires all revisions deprecated or retired."
    },
    {
      "id": "INV-SFT003-03",
      "rule": "Changing address, endpoint, or exposure alone changes neither contract revision nor Integration identity."
    },
    {
      "id": "INV-SFT003-04",
      "rule": "Every semantic change creates a new revision; payload meaning is referenced from immutable WM-DAT-004 revisions."
    },
    {
      "id": "INV-SFT003-05",
      "rule": "A payload-bearing operation has at least one schemaRef; a bodyless revision may have zero; cardinality is 0..n per revision."
    },
    {
      "id": "INV-SFT003-06",
      "rule": "ConsumerPin targets exactly one published or deprecated revision; latest is query behavior and never stored identity."
    },
    {
      "id": "INV-SFT003-07",
      "rule": "A retired revision accepts no new pins; historical pins and messages remain resolvable."
    },
    {
      "id": "INV-SFT003-08",
      "rule": "A ConsumerPin is written only by competent consumer authority; a provider may propose and notify but cannot repin."
    },
    {
      "id": "INV-SFT003-09",
      "rule": "Unpinned use is valid only with an immutable RevisionResolutionRecord naming the selected exact revision."
    },
    {
      "id": "INV-SFT003-10",
      "rule": "Concurrent pins require disjoint or explicitly overlapping scopes; dual run is two scoped pin rows."
    },
    {
      "id": "INV-SFT003-11",
      "rule": "RevisionExposure explicitly targets family or revision and binds one endpoint, environment, protocol, media type, and interval."
    },
    {
      "id": "INV-SFT003-12",
      "rule": "Overlapping exposures require explicit purpose and scope; blue/green and DR are admitted concurrent cases."
    },
    {
      "id": "INV-SFT003-13",
      "rule": "Effective reachability is the interval intersection of exposure and endpoint address binding; empty intersection is unresolvable."
    },
    {
      "id": "INV-SFT003-14",
      "rule": "An exchange occurrence cites at most one exact revision and one exposure; WM-SFT-003 stores and navigates no occurrence collection."
    },
    {
      "id": "INV-SFT003-15",
      "rule": "Declared auth and service targets contain no credentials, secrets, tokens, private keys, or observed measurements."
    },
    {
      "id": "INV-SFT003-16",
      "rule": "Every compatibility result states baseline range, declared mode, evidence, and any bounded expiring exception authority."
    },
    {
      "id": "INV-SFT003-17",
      "rule": "Removing operations or required elements, incompatible narrowing, defaultless required reads, or changed meaning is breaking."
    },
    {
      "id": "INV-SFT003-18",
      "rule": "Dependent rows are append-only and unique by natural key; corrections supersede rows and as-of queries state valid and record time."
    },
    {
      "id": "INV-SFT003-19",
      "rule": "Intervals are half-open UTC [from,to); to is greater than from; null to is open-ended."
    },
    {
      "id": "INV-SFT003-20",
      "rule": "Test harnesses, probes, intra-component calls, and ephemeral call paths do not establish Integration identity."
    }
  ],
  "holds": [
    "Integration grain, natural key, purpose discriminator, collision rules and registry allocation remain unresolved.",
    "ConsumptionRouting is deferred until Integration is allocated; no integrationRef exists.",
    "Environment, owner, authority and consumer reference targets must be resolved from the registry before publication.",
    "WM-DAT-004 retains its canonical publication holds.",
    "Canonical publication and live verification are held; no new runtime ID."
  ]
}