{
  "format": "vercy-world-model-candidate/v1",
  "contourId": "EM-TEC-03",
  "modelId": "WM-SFT-018",
  "registryId": "vr.wm-sft-018",
  "name": "Network / Endpoint",
  "version": "0.1.0-candidate.2",
  "entryKind": "network-endpoint-aggregate",
  "status": "research-candidate",
  "canonicalPublishable": false,
  "purpose": "Represent stable logical endpoint identity plus append-only effective-dated address, connectivity, exposure and zone assertions without owning software, runtime, interface, traffic observation or secret identity.",
  "boundary": {
    "owns": [
      "logical endpoint identity and lifecycle",
      "effective-dated address bindings",
      "directional connectivity declarations",
      "bounded exposure assertions",
      "zone membership and tombstone history"
    ],
    "delegates": [
      "software system identity to WM-SFT-002",
      "runtime identity to WM-SFT-010",
      "contract exposure to WM-SFT-003",
      "observed telemetry to WM-SFT-017"
    ],
    "excludes": [
      "credentials secrets tokens and private keys",
      "software or runtime mastership",
      "contract and schema semantics",
      "observed traffic or reachability",
      "address as eternal identity"
    ]
  },
  "temporal": {
    "interval": "half-open [from,to)",
    "timeBasis": "UTC millisecond precision",
    "openEnd": "null to",
    "recordTime": "recordedAt is append-only; corrections use supersedesLocalHandle"
  },
  "objects": {
    "NetworkEndpoint": {
      "naturalKey": [
        "endpointId"
      ],
      "required": [
        "endpointId",
        "name",
        "endpointKind",
        "ownerRef",
        "status"
      ],
      "optional": [
        "logicalServiceRef",
        "successorEndpointId",
        "retiredAt"
      ],
      "lifecycle": [
        "planned",
        "active",
        "retired"
      ]
    },
    "AddressBinding": {
      "naturalKey": [
        "endpointRef",
        "addressKind",
        "addressValue",
        "environmentRef",
        "scopeRef",
        "validFrom"
      ],
      "required": [
        "endpointRef",
        "addressKind",
        "addressValue",
        "environmentRef",
        "scopeRef",
        "validFrom",
        "authorityRef",
        "recordedAt",
        "status"
      ],
      "optional": [
        "validTo",
        "resolutionEvidenceRef",
        "localHandle",
        "supersedesLocalHandle"
      ],
      "lifecycle": [
        "proposed",
        "effective",
        "superseded",
        "withdrawn"
      ]
    },
    "ConnectivityRelation": {
      "naturalKey": [
        "sourceEndpointRef",
        "targetEndpointRef",
        "protocol",
        "portOrChannel",
        "validFrom"
      ],
      "required": [
        "sourceEndpointRef",
        "targetEndpointRef",
        "protocol",
        "portOrChannel",
        "validFrom",
        "authorityRef",
        "recordedAt",
        "status"
      ],
      "optional": [
        "validTo",
        "direction",
        "evidenceRefs",
        "localHandle",
        "supersedesLocalHandle"
      ],
      "lifecycle": [
        "proposed",
        "effective",
        "superseded",
        "withdrawn"
      ]
    },
    "ExposureAssertion": {
      "naturalKey": [
        "endpointRef",
        "audienceScope",
        "scopeRef",
        "effectiveFrom"
      ],
      "required": [
        "endpointRef",
        "audienceScope",
        "accessMode",
        "scopeRef",
        "effectiveFrom",
        "authorityRef",
        "policyRef",
        "recordedAt",
        "status"
      ],
      "optional": [
        "effectiveTo",
        "evidenceRefs",
        "confidence",
        "localHandle",
        "supersedesLocalHandle"
      ],
      "lifecycle": [
        "proposed",
        "effective",
        "superseded",
        "withdrawn"
      ]
    },
    "ZoneMembership": {
      "naturalKey": [
        "endpointRef",
        "zoneRef",
        "validFrom"
      ],
      "required": [
        "endpointRef",
        "zoneRef",
        "validFrom",
        "authorityRef",
        "recordedAt",
        "status"
      ],
      "optional": [
        "validTo",
        "evidenceRefs",
        "localHandle",
        "supersedesLocalHandle"
      ],
      "lifecycle": [
        "proposed",
        "effective",
        "superseded",
        "withdrawn"
      ]
    }
  },
  "relations": [
    {
      "target": "WM-SFT-002",
      "relation": "REFERENCE",
      "required": false,
      "purpose": "Logical service or software system."
    },
    {
      "target": "WM-SFT-010",
      "relation": "REFERENCE",
      "required": false,
      "purpose": "Hosting runtime or resource."
    },
    {
      "target": "WM-SFT-017",
      "relation": "REFERENCE",
      "required": false,
      "purpose": "Observed telemetry without copying measurements."
    }
  ],
  "incomingRelations": [
    {
      "source": "WM-SFT-003",
      "relation": "REFERENCE",
      "navigable": false,
      "purpose": "Contract exposure cites endpoint; endpoint stores no mirrored binding."
    }
  ],
  "invariants": [
    {
      "id": "INV-SFT018-01",
      "rule": "Endpoint identity is independent of IP, host, URL, port, protocol, runtime resource, and interface revision."
    },
    {
      "id": "INV-SFT018-02",
      "rule": "Dependent facts are unique by natural key; local handles never replace parent-scoped identity."
    },
    {
      "id": "INV-SFT018-03",
      "rule": "Address reassignment never merges endpoint identity; retired endpoints retain tombstones and acyclic successor evidence."
    },
    {
      "id": "INV-SFT018-04",
      "rule": "Concurrent address bindings require explicit distinct scope or environment."
    },
    {
      "id": "INV-SFT018-05",
      "rule": "Connectivity is directional unless explicitly bidirectional and never proves observed traffic or current reachability."
    },
    {
      "id": "INV-SFT018-06",
      "rule": "Exposure states audience, access mode, authority, policy, scope, and effective interval."
    },
    {
      "id": "INV-SFT018-07",
      "rule": "Credentials, secrets, tokens and private keys are never stored."
    },
    {
      "id": "INV-SFT018-08",
      "rule": "Runtime replacement preserves endpoint identity when logical exposure is continuous."
    },
    {
      "id": "INV-SFT018-09",
      "rule": "Historical resolution uses valid time and record time; corrections append and supersede rather than edit."
    },
    {
      "id": "INV-SFT018-10",
      "rule": "Intervals are half-open UTC [from,to); to is greater than from; null to is open-ended."
    },
    {
      "id": "INV-SFT018-11",
      "rule": "A complete connectivity or exposure inventory inherits the strictest member classification and policy ceiling."
    },
    {
      "id": "INV-SFT018-12",
      "rule": "One authority governs an address namespace at a time; conflicts are recorded and not silently resolved."
    },
    {
      "id": "INV-SFT018-13",
      "rule": "Declared and observed network facts remain separate even when telemetry contradicts a declaration."
    }
  ],
  "holds": [
    "Registry confirmation of WM-SFT-002, WM-SFT-010 and WM-SFT-017 is required before advancement.",
    "Environment, owner, authority, policy, scope and zone reference targets must be resolved from existing registry entries before publication.",
    "Canonical publication and live verification are held; no new runtime ID."
  ]
}