{
  "contract": "certarail.environment-taxonomy.v1",
  "version": 1,
  "classification_basis": "Classify every capability and exact execution boundary by the most consequential data, network, credential, money or asset, and external-target boundary it can reach. A hostname, branch, tenant name, CI stage, deployment label, or URL alone never determines the canonical class.",
  "unresolved_policy": "When evidence is insufficient to select one of the five classes, do not infer a favorable class. Capability Status may use UNKNOWN as a fail-closed resolution sentinel with unknown availability and non-active activation; UNKNOWN is not a sixth environment.",
  "definitions": {
    "DEMO": {
      "class": "DEMO",
      "display_name": "Demo",
      "purpose": "Explain a product journey or let a user explore deterministic interface states without connecting an operational tenant or external provider.",
      "data": {
        "policy": "SYNTHETIC_ONLY",
        "permitted": [
          "Reviewed synthetic fixtures, fictional identities, and non-sensitive example values."
        ],
        "prohibited": [
          "Customer, employee, counterparty, production, regulated, or otherwise real personal and business data."
        ],
        "retention_boundary": "Static content or ephemeral session state only; no durable customer record is created."
      },
      "network": {
        "scope": "STATIC_OR_IN_PROCESS",
        "ingress": "Public read access or an unauthenticated local preview may serve the demo surface.",
        "egress": "Business, provider, messaging, payment, custody, blockchain, and regulator egress is prohibited; only same-surface static assets and in-process fixtures are allowed.",
        "provider_targets": "PROHIBITED"
      },
      "credentials": {
        "policy": "NONE",
        "permitted": [
          "No operational credential is required; anonymous demo session identifiers may be ephemeral and non-authorizing."
        ],
        "prohibited": [
          "Tenant API keys, provider credentials, production credentials, secrets, and customer authentication material."
        ],
        "storage_boundary": "The demo surface must not collect, persist, log, or render secrets."
      },
      "money_assets": {
        "mode": "NONE",
        "real_value_prohibited": true,
        "detail": "Displayed prices, balances, quotes, fills, payments, and assets are fictional presentation values only and cannot be funded, withdrawn, settled, or transferred."
      },
      "external_effect": {
        "allowed_levels": ["NONE", "SIMULATED"],
        "ceiling": "SIMULATED",
        "target_boundary": "Effects remain inside the browser or in-process fixture. A demo never calls or changes a real external target."
      },
      "activation_gates": [
        {
          "code": "DEMO_SCENARIO_APPROVED",
          "owner": "PRODUCT",
          "requirement": "The scenario, labels, states, and recovery paths are reviewed as illustrative rather than operational claims.",
          "evidence": "Versioned scenario inventory and product-owner approval."
        },
        {
          "code": "DEMO_DATA_BOUNDARY_VERIFIED",
          "owner": "DATA_GOVERNANCE",
          "requirement": "Every rendered and submitted value is synthetic and the surface rejects or avoids free-form real data.",
          "evidence": "Fixture review plus negative tests for sensitive or real-data collection."
        },
        {
          "code": "DEMO_EGRESS_HARD_DISABLED",
          "owner": "SECURITY",
          "requirement": "External business and provider calls are technically absent or hard-disabled.",
          "evidence": "Network boundary review and a test proving zero external calls."
        },
        {
          "code": "DEMO_TRUTH_LABEL_PUBLISHED",
          "owner": "PRODUCT",
          "requirement": "The UI identifies simulated outcomes and does not imply execution, delivery, custody, settlement, approval, or production readiness.",
          "evidence": "Approved content snapshot and presentation test."
        }
      ]
    },
    "LOCAL": {
      "class": "LOCAL",
      "display_name": "Local",
      "purpose": "Develop, debug, and verify CertaRail on a developer-controlled workstation or isolated local container network.",
      "data": {
        "policy": "NON_PRODUCTION_TEST_ONLY",
        "permitted": [
          "Synthetic fixtures and explicitly approved de-identified test data."
        ],
        "prohibited": [
          "Production databases, live customer or counterparty records, unapproved personal data, and copied production payloads."
        ],
        "retention_boundary": "Disposable developer-owned storage with documented reset and no production retention promise."
      },
      "network": {
        "scope": "LOCAL_ONLY",
        "ingress": "Loopback or an explicitly isolated developer network only.",
        "egress": "External provider egress is denied by default. Enabling an official provider test endpoint reclassifies that capability boundary as Provider Sandbox.",
        "provider_targets": "PROHIBITED"
      },
      "credentials": {
        "policy": "LOCAL_DEVELOPMENT_ONLY",
        "permitted": [
          "Replaceable local development credentials scoped to local fixtures and isolated services."
        ],
        "prohibited": [
          "Production credentials, provider sandbox credentials, shared long-lived secrets, and real customer authentication material."
        ],
        "storage_boundary": "Local credentials stay outside source control, logs, evidence payloads, and browser persistence."
      },
      "money_assets": {
        "mode": "SIMULATED_ONLY",
        "real_value_prohibited": true,
        "detail": "Ledgers and assets are local synthetic records with no monetary, custody, settlement, withdrawal, or transfer effect."
      },
      "external_effect": {
        "allowed_levels": ["NONE", "SIMULATED"],
        "ceiling": "SIMULATED",
        "target_boundary": "Effects are confined to the developer process, local database, local queues, and fixtures; no external provider state may change."
      },
      "activation_gates": [
        {
          "code": "LOCAL_ACCESS_BOUNDARY_VERIFIED",
          "owner": "ENGINEERING",
          "requirement": "Ingress is limited to loopback or an explicitly isolated development network.",
          "evidence": "Runtime configuration inspection and local connectivity test."
        },
        {
          "code": "LOCAL_DATA_BOUNDARY_VERIFIED",
          "owner": "DATA_GOVERNANCE",
          "requirement": "Only synthetic or approved de-identified test data is loaded.",
          "evidence": "Fixture provenance and data-set review."
        },
        {
          "code": "LOCAL_CREDENTIALS_ISOLATED",
          "owner": "SECURITY",
          "requirement": "Only replaceable development credentials are present and no secret is committed or persisted in the browser.",
          "evidence": "Configuration review and secret scan."
        },
        {
          "code": "LOCAL_EGRESS_VERIFIED",
          "owner": "ENGINEERING",
          "requirement": "Provider, payment, messaging, custody, blockchain, and regulator egress is absent or hard-disabled.",
          "evidence": "Network-policy inspection and focused zero-external-call tests."
        }
      ]
    },
    "HOSTED_SANDBOX": {
      "class": "HOSTED_SANDBOX",
      "display_name": "Hosted Sandbox",
      "purpose": "Run tenant-scoped CertaRail non-production workflows in a remotely hosted environment without connecting an external provider account.",
      "data": {
        "policy": "NON_PRODUCTION_TEST_ONLY",
        "permitted": [
          "Synthetic and explicitly approved pseudonymized test data within the documented tenant boundary."
        ],
        "prohibited": [
          "Production data, live regulated records, production secrets, and unapproved personal or commercially sensitive data."
        ],
        "retention_boundary": "Documented sandbox retention and deletion policy with tenant isolation; no production retention or residency claim is inherited."
      },
      "network": {
        "scope": "HOSTED_ISOLATED",
        "ingress": "Authenticated tenant-scoped access through the approved hosted sandbox edge.",
        "egress": "Only CertaRail-managed sandbox infrastructure is reachable. External provider business endpoints remain hard-disabled.",
        "provider_targets": "PROHIBITED"
      },
      "credentials": {
        "policy": "HOSTED_SANDBOX_ONLY",
        "permitted": [
          "CertaRail-issued revocable sandbox identity and service credentials scoped to one hosted tenant."
        ],
        "prohibited": [
          "Provider credentials, production credentials, live signing keys, and credentials shared across tenants."
        ],
        "storage_boundary": "Sandbox secrets use the hosted secret boundary, are never returned after issuance, and never enter source, logs, evidence, or browser storage."
      },
      "money_assets": {
        "mode": "SIMULATED_ONLY",
        "real_value_prohibited": true,
        "detail": "Hosted ledgers, quotes, payments, fills, balances, and assets are non-monetary synthetic facts; no real funding, custody, settlement, withdrawal, or transfer is permitted."
      },
      "external_effect": {
        "allowed_levels": ["NONE", "SIMULATED"],
        "ceiling": "SIMULATED",
        "target_boundary": "Effects may persist inside the isolated hosted sandbox, but no external provider, customer system, mailbox, regulator, bank, chain, or custody target is read or changed."
      },
      "activation_gates": [
        {
          "code": "HOSTED_TENANT_ACCESS_APPROVED",
          "owner": "SECURITY",
          "requirement": "Tenant identity, authorization, isolation, revocation, and audit boundaries are enabled for the hosted sandbox.",
          "evidence": "Access-control review and cross-tenant negative tests."
        },
        {
          "code": "HOSTED_TEST_DATA_APPROVED",
          "owner": "DATA_GOVERNANCE",
          "requirement": "The permitted test-data classes, retention, deletion, and support-access boundary are documented and approved.",
          "evidence": "Sandbox data policy, data inventory, and deletion evidence."
        },
        {
          "code": "HOSTED_CREDENTIALS_READY",
          "owner": "SECURITY",
          "requirement": "Tenant-scoped sandbox credentials can be issued, rotated, revoked, and audited without exposing secret material.",
          "evidence": "Credential lifecycle test and audit reference."
        },
        {
          "code": "HOSTED_PROVIDER_EGRESS_HARD_DISABLED",
          "owner": "ENGINEERING",
          "requirement": "External provider and business-effect targets are technically blocked for this environment.",
          "evidence": "Egress policy plus negative provider-call test."
        },
        {
          "code": "HOSTED_SANDBOX_OPERATIONS_READY",
          "owner": "OPERATIONS",
          "requirement": "Monitoring, bounded support access, backup expectations, incident handling, and sandbox recovery are documented.",
          "evidence": "Sandbox runbook and exercised recovery observation."
        }
      ]
    },
    "PROVIDER_SANDBOX": {
      "class": "PROVIDER_SANDBOX",
      "display_name": "Provider Sandbox",
      "purpose": "Verify an adapter against an external provider's official non-production account, endpoints, failure modes, and recovery contract.",
      "data": {
        "policy": "NON_PRODUCTION_TEST_ONLY",
        "permitted": [
          "Synthetic provider fixtures, provider-issued test identifiers, and approved pseudonymized test inputs required for UAT."
        ],
        "prohibited": [
          "Production customer records, live payment or custody instructions, production account identifiers, and unapproved personal data."
        ],
        "retention_boundary": "CertaRail and provider test-data retention, deletion, and support-access rules are both recorded before activation."
      },
      "network": {
        "scope": "PROVIDER_SANDBOX_ONLY",
        "ingress": "The invoking CertaRail Local or Hosted Sandbox identity is authenticated and scoped to the approved UAT path.",
        "egress": "Only allowlisted official provider sandbox hosts and ports are reachable; DNS, TLS, certificate, and redirect boundaries are verified.",
        "provider_targets": "SANDBOX_ONLY"
      },
      "credentials": {
        "policy": "PROVIDER_SANDBOX_ONLY",
        "permitted": [
          "Provider-issued sandbox credentials scoped to the named test account and minimum required operations."
        ],
        "prohibited": [
          "Production provider credentials, customer credentials, reusable signing material in source or logs, and credentials valid for a live account."
        ],
        "storage_boundary": "Sandbox provider secrets are injected from an approved secret store, redacted from logs and evidence, rotated, and revocable."
      },
      "money_assets": {
        "mode": "PROVIDER_TEST_ONLY",
        "real_value_prohibited": true,
        "detail": "Only provider-designated fake funds and test assets without redeemable, withdrawable, transferable, custody, settlement, or legal value are allowed."
      },
      "external_effect": {
        "allowed_levels": [
          "NONE",
          "SIMULATED",
          "EXTERNAL_READ",
          "EXTERNAL_WRITE"
        ],
        "ceiling": "EXTERNAL_WRITE",
        "target_boundary": "The capability may read or change external state only inside the named provider test account. This is a real external call but never proof of production eligibility or real money or asset movement."
      },
      "activation_gates": [
        {
          "code": "PROVIDER_SANDBOX_ACCOUNT_APPROVED",
          "owner": "INTEGRATIONS",
          "requirement": "The provider, official sandbox account, permitted APIs, ownership, and terms of use are recorded.",
          "evidence": "Provider account reference and owner approval."
        },
        {
          "code": "PROVIDER_SANDBOX_CREDENTIALS_READY",
          "owner": "SECURITY",
          "requirement": "Sandbox credentials are scoped, stored, injected, rotated, revoked, and redacted under the approved secret lifecycle.",
          "evidence": "Credential-scope review and secret lifecycle test."
        },
        {
          "code": "PROVIDER_SANDBOX_NETWORK_APPROVED",
          "owner": "SECURITY",
          "requirement": "Egress reaches only official provider sandbox targets and fails closed on host, TLS, redirect, or certificate mismatch.",
          "evidence": "Allowlist review and authenticated connectivity observation."
        },
        {
          "code": "PROVIDER_TEST_VALUE_BOUNDARY_VERIFIED",
          "owner": "RISK",
          "requirement": "The account cannot hold, receive, withdraw, settle, custody, or transfer anything with real monetary or legal value.",
          "evidence": "Provider documentation plus account-level observation."
        },
        {
          "code": "PROVIDER_SANDBOX_UAT_READY",
          "owner": "INTEGRATIONS",
          "requirement": "Success, rejection, timeout, duplicate, unknown-outcome, lookup, reconciliation, and rollback paths have acceptance criteria.",
          "evidence": "Executed provider sandbox UAT and recovery evidence."
        }
      ]
    },
    "PRODUCTION": {
      "class": "PRODUCTION",
      "display_name": "Production",
      "purpose": "Run explicitly authorized live capabilities against approved production systems for real organizational operations.",
      "data": {
        "policy": "GOVERNED_PRODUCTION",
        "permitted": [
          "Minimum necessary production data within approved purpose, classification, residency, access, retention, deletion, and processor boundaries."
        ],
        "prohibited": [
          "Unclassified data, data beyond the approved purpose, secrets in business payloads, and production data copied to a lower environment."
        ],
        "retention_boundary": "Approved production records schedule, deletion and legal-hold workflow, residency decision, processor map, and auditable access apply."
      },
      "network": {
        "scope": "PRODUCTION_ALLOWLISTED",
        "ingress": "Only approved production identities, edges, protocols, and tenant or organization boundaries may invoke the capability.",
        "egress": "Only named production targets, operations, protocols, regions, and failure policies approved for the capability are reachable.",
        "provider_targets": "PRODUCTION_ALLOWLISTED"
      },
      "credentials": {
        "policy": "PRODUCTION_MANAGED",
        "permitted": [
          "Least-privilege production service identities and provider credentials bound to approved accounts, operations, owners, and rotation policy."
        ],
        "prohibited": [
          "Developer, demo, shared, test, browser-stored, source-controlled, loggable, or unowned credentials and signing material."
        ],
        "storage_boundary": "Production secrets are generated or imported, stored, accessed, rotated, revoked, and audited through the approved KMS or secret-management boundary."
      },
      "money_assets": {
        "mode": "REAL_POSSIBLE",
        "real_value_prohibited": false,
        "detail": "Real monetary or asset effect is possible only for capabilities whose exact accounts, limits, mandates, approvals, reconciliation, custody, and rollback or compensation controls are separately activated. Production classification alone authorizes nothing."
      },
      "external_effect": {
        "allowed_levels": [
          "NONE",
          "SIMULATED",
          "EXTERNAL_READ",
          "EXTERNAL_WRITE"
        ],
        "ceiling": "EXTERNAL_WRITE",
        "target_boundary": "A capability may read or request changes at named live external targets only within its approved scope. A request is not proof that a provider accepted, executed, settled, submitted, delivered, or finalized it."
      },
      "activation_gates": [
        {
          "code": "PRODUCTION_AUTHORITY_APPROVED",
          "owner": "LEGAL",
          "requirement": "Contracts, participant responsibilities, jurisdiction, licences or permissions, and authority for the exact live operation are approved.",
          "evidence": "Executed legal and commercial approval references."
        },
        {
          "code": "PRODUCTION_DATA_GOVERNANCE_APPROVED",
          "owner": "DATA_GOVERNANCE",
          "requirement": "Purpose, lawful basis where applicable, classification, residency, processors, retention, deletion, legal hold, and data-subject or customer obligations are approved.",
          "evidence": "Approved production data inventory and control records."
        },
        {
          "code": "PRODUCTION_SECURITY_APPROVED",
          "owner": "SECURITY",
          "requirement": "Threat model, tenant isolation, IAM, key and secret lifecycle, encryption, logging, vulnerability management, and incident controls pass the scoped production review.",
          "evidence": "Security acceptance and unresolved-risk register."
        },
        {
          "code": "PRODUCTION_CREDENTIALS_NETWORK_READY",
          "owner": "SECURITY",
          "requirement": "Named production identities, credentials, endpoints, allowlists, TLS or mTLS, rotation, revocation, and break-glass controls are verified.",
          "evidence": "Dated production connectivity and credential lifecycle observation."
        },
        {
          "code": "PROVIDER_UAT_ACCEPTED",
          "owner": "INTEGRATIONS",
          "requirement": "Provider Sandbox UAT covers success, failure, timeout, duplicate, unknown outcome, lookup, reconciliation, rate limits, and recovery for the release candidate.",
          "evidence": "Owner-approved UAT protocol and executed evidence."
        },
        {
          "code": "PRODUCTION_MONEY_ASSET_CONTROLS_APPROVED",
          "owner": "RISK",
          "requirement": "Applicable accounts, mandates, maker-checker, limits, funding, custody, settlement, reconciliation, and compensation controls are approved for real value.",
          "evidence": "Risk and operations approval bound to exact capability, accounts, and limits."
        },
        {
          "code": "PRODUCTION_OPERATIONS_RECOVERY_READY",
          "owner": "OPERATIONS",
          "requirement": "Monitoring, SLOs, capacity, backups, restore, disaster recovery, on-call, incident response, reconciliation, rollback, and support ownership are exercised.",
          "evidence": "Runbooks and dated operational exercise results."
        },
        {
          "code": "CAPABILITY_OWNER_ACTIVATION_APPROVED",
          "owner": "PRODUCT_OWNER",
          "requirement": "The exact version, environment ID, capability operations, effect boundary, open blockers, evidence, start time, rollback condition, and accountable owner are approved.",
          "evidence": "Owner-approved Capability Status record with production acceptance and runtime evidence."
        }
      ]
    }
  }
}