For reading and verification only. You may not copy, use, modify or redistribute this code. Full notice on the main page.
contracts/policy.json
| 1 | { |
| 2 | "$comment": "ALL 2.0 policy table: the ONE place where a number, a window or a limit of the end-to-end path is written down (plan section 0 and 7.1). The tunnel node (Go), the control plane (TypeScript) and the device (Python) read it; nobody copies a value into code (the contract generator lint fails the suite when one does). Units are in the key suffix: _s seconds, _bytes, _days, _pct percent. Keys listed in `provisional` are the plan's initial values: they are retuned after G0 and G1 and ONLY here.", |
| 3 | "version": 1, |
| 4 | "provisional": [ |
| 5 | "timing.stream_idle_s", |
| 6 | "timing.stream_max_age_s", |
| 7 | "timing.ping_interval_s", |
| 8 | "timing.dead_peer_s", |
| 9 | "node_limits.per_ip_concurrent", |
| 10 | "node_limits.per_ip_new_per_s", |
| 11 | "node_limits.label_streams_max", |
| 12 | "node_limits.label_anon_slice", |
| 13 | "node_limits.label_hint_slice", |
| 14 | "node_limits.global_streams_max", |
| 15 | "node_limits.openai_reserved_pct", |
| 16 | "node_limits.openai_per_ip_factor", |
| 17 | "node_limits.device_per_ip_factor", |
| 18 | "node_limits.ip_table_max", |
| 19 | "node_limits.unknown_sni_per_ip", |
| 20 | "node_limits.unknown_sni_window_s", |
| 21 | "node_limits.unknown_sni_ban_s", |
| 22 | "node_limits.label_new_per_s", |
| 23 | "node_limits.label_new_burst", |
| 24 | "node_limits.hint_addresses_per_label", |
| 25 | "terminator.endpoint_budgets", |
| 26 | "terminator.max_streams", |
| 27 | "budget.borrow_from", |
| 28 | "budget.defer_jitter_s", |
| 29 | "budget.dns_calls_per_reservation", |
| 30 | "budget.reservations_per_label_per_day", |
| 31 | "budget.trial_per_ip_per_window", |
| 32 | "budget.trial_per_email_domain_per_window", |
| 33 | "budget.trial_per_mailbox_per_window", |
| 34 | "budget.lapsed_lift_after_s", |
| 35 | "budget.abandons_per_label_per_window", |
| 36 | "monitoring.lapsed_held_alert", |
| 37 | "monitoring.jwks_age_alert_s", |
| 38 | "monitoring.authorize_window_s", |
| 39 | "monitoring.authorize_fail_alert_pct", |
| 40 | "monitoring.authorize_fail_min_calls", |
| 41 | "monitoring.criteria_min_coverage_pct", |
| 42 | "migration.connected_now_s", |
| 43 | "migration.migrate_floor_pct", |
| 44 | "migration.lend_horizon_s", |
| 45 | "migration.ineligible_hold_s", |
| 46 | "migration.retire.min_days_since_ready", |
| 47 | "migration.retire.sustain_days", |
| 48 | "migration.retire.node_availability_permille_min", |
| 49 | "migration.retire.authorize_failure_pct_max", |
| 50 | "migration.retire.migrated_pct_min", |
| 51 | "migration.retire.open_kill_events_max", |
| 52 | "dns_failover.remove_after_failures", |
| 53 | "dns_failover.restore_after_successes", |
| 54 | "dns_failover.min_change_interval_s", |
| 55 | "concierge.turns_per_session", |
| 56 | "concierge.mutations_per_session" |
| 57 | ], |
| 58 | |
| 59 | "protocol": { |
| 60 | "version": 2, |
| 61 | "alpn": "all-tunnel/2", |
| 62 | "line_max_bytes": 8192, |
| 63 | "open_line_max_bytes": 192, |
| 64 | "statement_line_max_bytes": 65552, |
| 65 | "jwt_max_bytes": 4096, |
| 66 | "first_line_timeout_s": 10, |
| 67 | "attach_timeout_s": 10, |
| 68 | "stream_id_bytes": 16, |
| 69 | "attach_secret_bytes": 32, |
| 70 | "nonce_bytes": 16, |
| 71 | "hint_max_addresses": 16, |
| 72 | "proof_htm": "GET", |
| 73 | "proof_htu_path": "/all-tunnel/2", |
| 74 | "node_assertion_header": "x-all-node-assertion", |
| 75 | "source_classes": ["openai", "hint", "anon"], |
| 76 | "close_reasons": ["replaced", "revoked", "expired", "released", "killed", "paused", "drain", "idle", "protocol", "shutdown"], |
| 77 | "error_codes": [ |
| 78 | "bad_hello", "bad_command", "unsupported_version", "bad_proof", "auth", "clock_skew", "unknown_stream", "bad_attach", |
| 79 | "license_inactive", "device_revoked", "paused", "busy", "control_unavailable", "line_too_long" |
| 80 | ] |
| 81 | }, |
| 82 | |
| 83 | "timing": { |
| 84 | "ping_interval_s": 20, |
| 85 | "dead_peer_s": 45, |
| 86 | "stream_idle_s": 1800, |
| 87 | "stream_max_age_s": 14400, |
| 88 | "half_close_s": 30, |
| 89 | "backoff_min_s": 1, |
| 90 | "backoff_max_s": 60, |
| 91 | "renew_before_valid_until_s": 300, |
| 92 | "drain_quiet_s": 1200, |
| 93 | "feed_poll_s": 15, |
| 94 | "feed_apply_deadline_s": 20, |
| 95 | "reconnect_after_wake_s": 5 |
| 96 | }, |
| 97 | |
| 98 | "authorization": { |
| 99 | "valid_until_paid_s": 14400, |
| 100 | "valid_until_trial_s": 900, |
| 101 | "valid_until_gated_s": 900, |
| 102 | "grace_paid_s": 900, |
| 103 | "authorize_max_concurrent": 50, |
| 104 | "session_ttl_s": 300, |
| 105 | "proof_ttl_s": 60, |
| 106 | "node_assertion_ttl_s": 60, |
| 107 | "node_skew_s": 5, |
| 108 | "node_skew_max_s": 30, |
| 109 | "access_ttl_paid_s": 14400, |
| 110 | "access_ttl_trial_s": 600, |
| 111 | "access_ttl_paywall_s": 600, |
| 112 | "access_future_slack_s": 60, |
| 113 | "stripe_status_cache_s": 120, |
| 114 | "last_seen_write_interval_s": 300 |
| 115 | }, |
| 116 | |
| 117 | "gated": { |
| 118 | "bytes_per_day": 10485760, |
| 119 | "streams_per_day": 200, |
| 120 | "cutoff_days": 14 |
| 121 | }, |
| 122 | |
| 123 | "license": { |
| 124 | "revoked_notice_days": 7 |
| 125 | }, |
| 126 | |
| 127 | "identity": { |
| 128 | "issuer": "https://api.all-mcp.fyi", |
| 129 | "aud_tunnel": "all-tunnel", |
| 130 | "aud_access": "all-device-access", |
| 131 | "aud_node_assertion": "all-tunnel-control", |
| 132 | "label_length": 20, |
| 133 | "label_alphabet": "abcdefghijklmnopqrstuvwxyz234567", |
| 134 | "label_regex": "^[a-z2-7]{20}$", |
| 135 | "fqdn_regex": "^[a-z2-7]{20}\\.(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\\.)+[a-z]{2,63}$", |
| 136 | "fqdn_max_length": 253, |
| 137 | "tombstone_idle_months": 12, |
| 138 | "device_id_regex": "^[a-f0-9]{32}$", |
| 139 | "stream_id_regex": "^[0-9a-f]{32}$", |
| 140 | "attach_secret_regex": "^[A-Za-z0-9_-]{43}$", |
| 141 | "nonce_regex": "^[A-Za-z0-9_-]{22,64}$", |
| 142 | "jti_regex": "^[A-Za-z0-9_-]{16,128}$", |
| 143 | "kid_regex": "^[A-Za-z0-9._-]{1,128}$" |
| 144 | }, |
| 145 | |
| 146 | "jwks": { |
| 147 | "cache_s": 300, |
| 148 | "max_keys": 16, |
| 149 | "stale_fail_closed_s": 1800 |
| 150 | }, |
| 151 | |
| 152 | "node_limits": { |
| 153 | "client_hello_deadline_s": 5, |
| 154 | "per_ip_concurrent": 16, |
| 155 | "per_ip_new_per_s": 10, |
| 156 | "ipv6_prefix_bits": 64, |
| 157 | "label_streams_max": 64, |
| 158 | "label_anon_slice": 16, |
| 159 | "label_hint_slice": 48, |
| 160 | "hint_ttl_s": 900, |
| 161 | "global_streams_max": 2048, |
| 162 | "openai_reserved_pct": 25, |
| 163 | "openai_prefix_refresh_s": 86400, |
| 164 | "openai_prefix_max": 2048, |
| 165 | "openai_prefix_min_v4_bits": 16, |
| 166 | "openai_prefix_min_v6_bits": 32, |
| 167 | "openai_prefix_body_max_bytes": 1048576, |
| 168 | "openai_per_ip_factor": 8, |
| 169 | "device_per_ip_factor": 8, |
| 170 | "ip_table_max": 65536, |
| 171 | "unknown_sni_per_ip": 20, |
| 172 | "unknown_sni_window_s": 60, |
| 173 | "unknown_sni_ban_s": 600, |
| 174 | "label_new_per_s": 20, |
| 175 | "label_new_burst": 32, |
| 176 | "hint_addresses_per_label": 64, |
| 177 | "tcp_keepalive_s": 30, |
| 178 | "max_unauthenticated_control": 256 |
| 179 | }, |
| 180 | |
| 181 | "terminator": { |
| 182 | "tls_handshake_s": 10, |
| 183 | "request_head_s": 10, |
| 184 | "request_head_max_bytes": 16384, |
| 185 | "max_streams": 64, |
| 186 | "endpoint_budgets": { |
| 187 | "register": {"per_ip_per_min": 20}, |
| 188 | "authorize": {"per_ip_per_min": 60}, |
| 189 | "token": {"per_ip_per_min": 120}, |
| 190 | "pair": {"per_ip_per_min": 30}, |
| 191 | "mcp_anonymous": {"per_ip_per_min": 60} |
| 192 | }, |
| 193 | "tls_min_version": "TLSv1.3", |
| 194 | "tls_alpn": "http/1.1" |
| 195 | }, |
| 196 | |
| 197 | "surface": { |
| 198 | "body_max_bytes": 16777216, |
| 199 | "headers_max": 64, |
| 200 | "header_value_max_bytes": 32768, |
| 201 | "keep_alive_s": 75, |
| 202 | "limiter_lru_max": 4096, |
| 203 | "never_authorized_client_evict_hours": 24, |
| 204 | "identity_path": "/__all/surface/v1/proof", |
| 205 | "identity_challenge_header": "x-all-challenge", |
| 206 | "identity_mac_header": "x-all-challenge-mac", |
| 207 | "identity_proof_header": "x-all-surface-proof" |
| 208 | }, |
| 209 | |
| 210 | "pairing": { |
| 211 | "window_s": 600, |
| 212 | "code_ttl_e2e_s": 600, |
| 213 | "code_ttl_local_s": 86400, |
| 214 | "max_codes_local": 16, |
| 215 | "bad_codes_burn": 5 |
| 216 | }, |
| 217 | |
| 218 | "certificates": { |
| 219 | "profile": "tlsserver", |
| 220 | "profile_fallback": "classic", |
| 221 | "profile_days": 45, |
| 222 | "renew_backstop_divisor": 3, |
| 223 | "ari_checks_per_day": 2, |
| 224 | "min_attempt_gap_s": 21600, |
| 225 | "max_issuances_per_day": 2, |
| 226 | "txt_ttl_s": 60, |
| 227 | "txt_value_length": 43, |
| 228 | "ct_check_interval_s": 86400, |
| 229 | "ct_degraded_after_s": 259200, |
| 230 | "wait_after_install_s": 300 |
| 231 | }, |
| 232 | |
| 233 | "dns": { |
| 234 | "a_record_ttl_s": 60, |
| 235 | "devices_caa": ["0 issue \"letsencrypt.org; validationmethods=dns-01\"", "0 issuewild \";\""], |
| 236 | "node_caa": ["0 issue \"letsencrypt.org\""] |
| 237 | }, |
| 238 | |
| 239 | "budget": { |
| 240 | "window_days": 7, |
| 241 | "first_issuances_total": 40, |
| 242 | "classes": {"paid": 20, "trial": 12, "flex": 8}, |
| 243 | "borrow_only_unreserved_hours": 24, |
| 244 | "per_label_per_window": 3, |
| 245 | "per_license_per_day": 2, |
| 246 | "reservation_ttl_s": 900, |
| 247 | "alert_pct": 70, |
| 248 | "borrow_from": {"paid": ["flex", "trial"], "trial": ["flex"], "flex": ["trial"]}, |
| 249 | "defer_jitter_s": 7200, |
| 250 | "dns_calls_per_reservation": 8, |
| 251 | "reservations_per_label_per_day": 8, |
| 252 | "lapsed_lift_after_s": 93600, |
| 253 | "abandons_per_label_per_window": 3, |
| 254 | "trial_per_ip_per_window": 3, |
| 255 | "trial_per_email_domain_per_window": 3, |
| 256 | "trial_per_mailbox_per_window": 2, |
| 257 | "free_mail_domains": [ |
| 258 | "gmail.com", "googlemail.com", "outlook.com", "hotmail.com", "live.com", "msn.com", "yahoo.com", "icloud.com", "me.com", "aol.com", |
| 259 | "proton.me", "protonmail.com", "gmx.com", "yandex.com", "mail.com", "zoho.com" |
| 260 | ] |
| 261 | }, |
| 262 | |
| 263 | "monitoring": { |
| 264 | "node_probe_interval_s": 300, |
| 265 | "probe_failures_to_alert": 2, |
| 266 | "node_cert_alert_days": [14, 5], |
| 267 | "ct_watch_interval_s": 900, |
| 268 | "lapsed_held_alert": 3, |
| 269 | "device_cert_expiring_days": 10, |
| 270 | "fleet_e2e_retention_s": 2592000, |
| 271 | "fleet_e2e_window_s": 86400, |
| 272 | "fleet_e2e_window_dedup_s": 172800, |
| 273 | "fleet_e2e_window_dedup_max": 8, |
| 274 | "jwks_age_alert_s": 900, |
| 275 | "authorize_bucket_s": 300, |
| 276 | "authorize_window_s": 900, |
| 277 | "authorize_fail_alert_pct": 10, |
| 278 | "authorize_fail_min_calls": 20, |
| 279 | "authorize_tally_keep_s": 259200, |
| 280 | "criteria_min_coverage_pct": 90 |
| 281 | }, |
| 282 | |
| 283 | "dns_failover": { |
| 284 | "remove_after_failures": 3, |
| 285 | "restore_after_successes": 5, |
| 286 | "min_change_interval_s": 600, |
| 287 | "min_in_rotation": 1, |
| 288 | "record_ttl_s": 60, |
| 289 | "hold_default_s": 7200, |
| 290 | "hold_max_s": 86400, |
| 291 | "log_entries": 50 |
| 292 | }, |
| 293 | |
| 294 | "release": { |
| 295 | "proof_max_age_h": 72 |
| 296 | }, |
| 297 | |
| 298 | "migration": { |
| 299 | "legacy_close_after_days": 30, |
| 300 | "delete_old_connector_after_days": 7, |
| 301 | "connected_now_s": 300, |
| 302 | "wave_hash_prefix": "all-e2e-wave-v1/", |
| 303 | "default_wave_pct": 100, |
| 304 | "min_lead_s": 60, |
| 305 | "min_version": "2.0.0", |
| 306 | "ready_report_max_age_s": 86400, |
| 307 | "verdict_cache_s": 300, |
| 308 | "migrate_floor_pct": 50, |
| 309 | "lend_horizon_s": 86400, |
| 310 | "ineligible_hold_s": 604800, |
| 311 | "enroll_refresh_min_s": 900, |
| 312 | "enroll_refresh_max_s": 1800, |
| 313 | "kill_apply_deadline_s": 3600, |
| 314 | "blocked_after_failures": 3, |
| 315 | "blocked_retry_s": 21600, |
| 316 | "retire": { |
| 317 | "$note": "The owner's figures of 2026-10-27 for retiring the old relay: every one of the last 30 complete UTC days has the nodes up at least 99.5 percent (_permille is thousandths: 995 is 99.5 percent, because nothing in this file is a fraction) and authorize failures at most 1 percent, and at least 95 percent of the eligible computers that enrolled have migrated. Even then the relay is retired only on the owner's explicit order.", |
| 318 | "min_days_since_ready": 14, |
| 319 | "sustain_days": 30, |
| 320 | "node_availability_permille_min": 995, |
| 321 | "authorize_failure_pct_max": 1, |
| 322 | "migrated_pct_min": 95, |
| 323 | "open_kill_events_max": 0 |
| 324 | }, |
| 325 | "selfcheck": { |
| 326 | "timeout_s": 10, |
| 327 | "min_interval_s": 60 |
| 328 | } |
| 329 | }, |
| 330 | |
| 331 | "keep_awake": { |
| 332 | "hold_cap_s": 28800, |
| 333 | "release_grace_s": 5, |
| 334 | "reconcile_s": 2 |
| 335 | }, |
| 336 | |
| 337 | "concierge": { |
| 338 | "$comment": "Robi concierge (owner order of 2026-10-27): a customer who proves an email with a one-time code gets a short session in which Robi can fix that customer's own account. Refund rules are the owner's exact ones and are in the Terms: a refund is refused when ALL ran more than max_actions_in_window actions in the refund window (monthly: the 3 days since the charge; lifetime: the 5 days since purchase). Not provisional: the owner set the number.", |
| 339 | "session_s": 1800, |
| 340 | "code_sends_per_net_hour": 6, |
| 341 | "code_checks_per_net_hour": 30, |
| 342 | "chat_turns_per_net_hour": 60, |
| 343 | "turns_per_day_total": 2000, |
| 344 | "voice_calls_per_session": 80, |
| 345 | "summary_chars_max": 800, |
| 346 | "turns_per_session": 40, |
| 347 | "tool_rounds_per_turn": 6, |
| 348 | "mutations_per_session": 8, |
| 349 | "history_messages_max": 16, |
| 350 | "user_chars_max": 1400, |
| 351 | "assistant_chars_max": 6000, |
| 352 | "history_chars_max": 24000, |
| 353 | "output_tokens_max": 1024, |
| 354 | "model_deadline_s": 25, |
| 355 | "audit_retention_days": 400, |
| 356 | "refund": { |
| 357 | "monthly_window_h": 72, |
| 358 | "lifetime_window_days": 5, |
| 359 | "max_actions_in_window": 100, |
| 360 | "confirm_ttl_s": 600 |
| 361 | } |
| 362 | }, |
| 363 | |
| 364 | "enums": { |
| 365 | "authorize_status": ["active", "gated", "paused"], |
| 366 | "statement_mode": ["active", "paywall"], |
| 367 | "budget_class": ["paid", "trial", "flex"], |
| 368 | "acme_purpose": ["first", "renewal"], |
| 369 | "reserve_status": ["granted", "deferred"], |
| 370 | "feed_event_type": ["revoke", "pause", "resume", "license_end", "release", "kill", "kill_clear"], |
| 371 | "e2e_state": ["off", "unenrolled", "waiting", "issuing", "connecting", "ready", "degraded", "clock_skew", "compat_only", "killed"], |
| 372 | "e2e_cohort": ["paid", "trial", "flex", "legacy"], |
| 373 | "ineligible_reason": ["update_not_in_plan", "legacy_credential", "unsupported_version"], |
| 374 | "selfcheck_reason": ["chain", "expired", "spki", "name", "tls_version", "healthz", "unreachable", "timeout"] |
| 375 | } |
| 376 | } |