For reading and verification only. You may not copy, use, modify or redistribute this code. Full notice on the main page.
src/all_mcp/e2e_policy.json
| 1 | { |
| 2 | "$comment": "ALL 2.0 policy table: the ONE place where a number, a window or a limit of the end-to-end path is written down (plan section 0 and 7.1). The tunnel node (Go), the control plane (TypeScript) and the device (Python) read it; nobody copies a value into code (the contract generator lint fails the suite when one does). Units are in the key suffix: _s seconds, _bytes, _days, _pct percent. Keys listed in `provisional` are the plan's initial values: they are retuned after G0 and G1 and ONLY here. This is the device projection (the `copies` of the contract lint table): only the sections that runtime reads.", |
| 3 | "version": 1, |
| 4 | "provisional": [ |
| 5 | "timing.stream_idle_s", |
| 6 | "timing.stream_max_age_s", |
| 7 | "timing.ping_interval_s", |
| 8 | "timing.dead_peer_s", |
| 9 | "node_limits.per_ip_concurrent", |
| 10 | "node_limits.per_ip_new_per_s", |
| 11 | "node_limits.openai_reserved_pct", |
| 12 | "terminator.endpoint_budgets", |
| 13 | "terminator.max_streams", |
| 14 | "migration.connected_now_s" |
| 15 | ], |
| 16 | "protocol": { |
| 17 | "version": 2, |
| 18 | "alpn": "all-tunnel/2", |
| 19 | "line_max_bytes": 8192, |
| 20 | "open_line_max_bytes": 192, |
| 21 | "statement_line_max_bytes": 65552, |
| 22 | "jwt_max_bytes": 4096, |
| 23 | "first_line_timeout_s": 10, |
| 24 | "attach_timeout_s": 10, |
| 25 | "stream_id_bytes": 16, |
| 26 | "attach_secret_bytes": 32, |
| 27 | "nonce_bytes": 16, |
| 28 | "hint_max_addresses": 16, |
| 29 | "proof_htm": "GET", |
| 30 | "proof_htu_path": "/all-tunnel/2", |
| 31 | "node_assertion_header": "x-all-node-assertion", |
| 32 | "source_classes": [ |
| 33 | "openai", |
| 34 | "hint", |
| 35 | "anon" |
| 36 | ], |
| 37 | "close_reasons": [ |
| 38 | "replaced", |
| 39 | "revoked", |
| 40 | "expired", |
| 41 | "released", |
| 42 | "killed", |
| 43 | "paused", |
| 44 | "drain", |
| 45 | "idle", |
| 46 | "protocol", |
| 47 | "shutdown" |
| 48 | ], |
| 49 | "error_codes": [ |
| 50 | "bad_hello", |
| 51 | "bad_command", |
| 52 | "unsupported_version", |
| 53 | "bad_proof", |
| 54 | "auth", |
| 55 | "clock_skew", |
| 56 | "unknown_stream", |
| 57 | "bad_attach", |
| 58 | "license_inactive", |
| 59 | "device_revoked", |
| 60 | "paused", |
| 61 | "busy", |
| 62 | "control_unavailable", |
| 63 | "line_too_long" |
| 64 | ] |
| 65 | }, |
| 66 | "timing": { |
| 67 | "ping_interval_s": 20, |
| 68 | "dead_peer_s": 45, |
| 69 | "stream_idle_s": 1800, |
| 70 | "stream_max_age_s": 14400, |
| 71 | "half_close_s": 30, |
| 72 | "backoff_min_s": 1, |
| 73 | "backoff_max_s": 60, |
| 74 | "renew_before_valid_until_s": 300, |
| 75 | "drain_quiet_s": 1200, |
| 76 | "feed_poll_s": 15, |
| 77 | "feed_apply_deadline_s": 20, |
| 78 | "reconnect_after_wake_s": 5 |
| 79 | }, |
| 80 | "authorization": { |
| 81 | "valid_until_paid_s": 14400, |
| 82 | "grace_paid_s": 900, |
| 83 | "access_ttl_paid_s": 14400, |
| 84 | "access_ttl_trial_s": 600, |
| 85 | "access_ttl_paywall_s": 600, |
| 86 | "access_future_slack_s": 60, |
| 87 | "node_skew_max_s": 30 |
| 88 | }, |
| 89 | "gated": { |
| 90 | "cutoff_days": 14 |
| 91 | }, |
| 92 | "identity": { |
| 93 | "issuer": "https://api.all-mcp.fyi", |
| 94 | "aud_tunnel": "all-tunnel", |
| 95 | "aud_access": "all-device-access", |
| 96 | "aud_node_assertion": "all-tunnel-control", |
| 97 | "label_length": 20, |
| 98 | "label_alphabet": "abcdefghijklmnopqrstuvwxyz234567", |
| 99 | "label_regex": "^[a-z2-7]{20}$", |
| 100 | "fqdn_regex": "^[a-z2-7]{20}\\.(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\\.)+[a-z]{2,63}$", |
| 101 | "fqdn_max_length": 253, |
| 102 | "tombstone_idle_months": 12, |
| 103 | "device_id_regex": "^[a-f0-9]{32}$", |
| 104 | "stream_id_regex": "^[0-9a-f]{32}$", |
| 105 | "attach_secret_regex": "^[A-Za-z0-9_-]{43}$", |
| 106 | "nonce_regex": "^[A-Za-z0-9_-]{22,64}$", |
| 107 | "jti_regex": "^[A-Za-z0-9_-]{16,128}$", |
| 108 | "kid_regex": "^[A-Za-z0-9._-]{1,128}$" |
| 109 | }, |
| 110 | "node_limits": { |
| 111 | "per_ip_concurrent": 16, |
| 112 | "per_ip_new_per_s": 10, |
| 113 | "ipv6_prefix_bits": 64, |
| 114 | "openai_reserved_pct": 25, |
| 115 | "hint_ttl_s": 900 |
| 116 | }, |
| 117 | "terminator": { |
| 118 | "tls_handshake_s": 10, |
| 119 | "request_head_s": 10, |
| 120 | "request_head_max_bytes": 16384, |
| 121 | "max_streams": 64, |
| 122 | "endpoint_budgets": { |
| 123 | "register": { |
| 124 | "per_ip_per_min": 20 |
| 125 | }, |
| 126 | "authorize": { |
| 127 | "per_ip_per_min": 60 |
| 128 | }, |
| 129 | "token": { |
| 130 | "per_ip_per_min": 120 |
| 131 | }, |
| 132 | "pair": { |
| 133 | "per_ip_per_min": 30 |
| 134 | }, |
| 135 | "mcp_anonymous": { |
| 136 | "per_ip_per_min": 60 |
| 137 | } |
| 138 | }, |
| 139 | "tls_min_version": "TLSv1.3", |
| 140 | "tls_alpn": "http/1.1" |
| 141 | }, |
| 142 | "surface": { |
| 143 | "body_max_bytes": 16777216, |
| 144 | "headers_max": 64, |
| 145 | "header_value_max_bytes": 32768, |
| 146 | "keep_alive_s": 75, |
| 147 | "limiter_lru_max": 4096, |
| 148 | "never_authorized_client_evict_hours": 24, |
| 149 | "identity_path": "/__all/surface/v1/proof", |
| 150 | "identity_challenge_header": "x-all-challenge", |
| 151 | "identity_mac_header": "x-all-challenge-mac", |
| 152 | "identity_proof_header": "x-all-surface-proof" |
| 153 | }, |
| 154 | "pairing": { |
| 155 | "window_s": 600, |
| 156 | "code_ttl_e2e_s": 600, |
| 157 | "code_ttl_local_s": 86400, |
| 158 | "max_codes_local": 16, |
| 159 | "bad_codes_burn": 5 |
| 160 | }, |
| 161 | "certificates": { |
| 162 | "profile": "tlsserver", |
| 163 | "profile_fallback": "classic", |
| 164 | "profile_days": 45, |
| 165 | "renew_backstop_divisor": 3, |
| 166 | "ari_checks_per_day": 2, |
| 167 | "min_attempt_gap_s": 21600, |
| 168 | "max_issuances_per_day": 2, |
| 169 | "txt_ttl_s": 60, |
| 170 | "txt_value_length": 43, |
| 171 | "ct_check_interval_s": 86400, |
| 172 | "ct_degraded_after_s": 259200, |
| 173 | "wait_after_install_s": 300 |
| 174 | }, |
| 175 | "migration": { |
| 176 | "legacy_close_after_days": 30, |
| 177 | "delete_old_connector_after_days": 7, |
| 178 | "connected_now_s": 300, |
| 179 | "wave_hash_prefix": "all-e2e-wave-v1/", |
| 180 | "enroll_refresh_min_s": 900, |
| 181 | "enroll_refresh_max_s": 1800, |
| 182 | "kill_apply_deadline_s": 3600, |
| 183 | "blocked_after_failures": 3, |
| 184 | "blocked_retry_s": 21600, |
| 185 | "selfcheck": { |
| 186 | "timeout_s": 10, |
| 187 | "min_interval_s": 60 |
| 188 | } |
| 189 | }, |
| 190 | "keep_awake": { |
| 191 | "hold_cap_s": 28800, |
| 192 | "release_grace_s": 5, |
| 193 | "reconcile_s": 2 |
| 194 | }, |
| 195 | "enums": { |
| 196 | "authorize_status": [ |
| 197 | "active", |
| 198 | "gated", |
| 199 | "paused" |
| 200 | ], |
| 201 | "statement_mode": [ |
| 202 | "active", |
| 203 | "paywall" |
| 204 | ], |
| 205 | "budget_class": [ |
| 206 | "paid", |
| 207 | "trial", |
| 208 | "flex" |
| 209 | ], |
| 210 | "acme_purpose": [ |
| 211 | "first", |
| 212 | "renewal" |
| 213 | ], |
| 214 | "reserve_status": [ |
| 215 | "granted", |
| 216 | "deferred" |
| 217 | ], |
| 218 | "feed_event_type": [ |
| 219 | "revoke", |
| 220 | "pause", |
| 221 | "resume", |
| 222 | "license_end", |
| 223 | "release", |
| 224 | "kill", |
| 225 | "kill_clear" |
| 226 | ], |
| 227 | "e2e_state": [ |
| 228 | "off", |
| 229 | "unenrolled", |
| 230 | "waiting", |
| 231 | "issuing", |
| 232 | "connecting", |
| 233 | "ready", |
| 234 | "degraded", |
| 235 | "clock_skew", |
| 236 | "compat_only", |
| 237 | "killed" |
| 238 | ], |
| 239 | "e2e_cohort": [ |
| 240 | "paid", |
| 241 | "trial", |
| 242 | "flex", |
| 243 | "legacy" |
| 244 | ], |
| 245 | "ineligible_reason": [ |
| 246 | "update_not_in_plan", |
| 247 | "legacy_credential", |
| 248 | "unsupported_version" |
| 249 | ], |
| 250 | "selfcheck_reason": [ |
| 251 | "chain", |
| 252 | "expired", |
| 253 | "spki", |
| 254 | "name", |
| 255 | "tls_version", |
| 256 | "healthz", |
| 257 | "unreachable", |
| 258 | "timeout" |
| 259 | ] |
| 260 | } |
| 261 | } |