Schemas
PolicyBundle
Section titled “PolicyBundle”A signed firewall policy bundle (section 18.5).
| Field | Type | Required | Constraints | Description |
|---|---|---|---|---|
alg |
“Ed25519” | yes | Signature algorithm. Ed25519 only. | |
kid |
string | yes | pattern ^[0-9a-f]{16}$ |
First 8 bytes of SHA-256(raw public key), 16 lower-case hex characters. |
payload |
string | yes | minLength 1, maxLength 87382, pattern ^[A-Za-z0-9_-]+$ |
The signed payload bytes (UTF-8 JSON, at most 64 KiB), base64url without padding. Verify the exact bytes; never re-serialise. |
sig |
string | yes | pattern ^[A-Za-z0-9_-]{86}$ |
Ed25519 signature (64 bytes, S below the group order) over utf8(“rg-policy-v1”) + 0x00 + payload bytes, base64url. |
SessionToken
Section titled “SessionToken”Offline-verifiable token (section 18.6): v1.<kid>.<payload b64url>.<sig b64url>, signed over utf8(“rg-session-v1”) + 0x00 + payload bytes with a key distinct from the bundle key. The payload holds sid host iat exp max lvl sc jti and nothing that identifies a person.
Type: string.