{
  "stage": 385,
  "policy_name": "Stage385 Cryptographic Agility & PQC Migration Policy",
  "policy_version": "1.0.0-development",
  "source_stage": 384,
  "development_only": true,
  "formal_acceptance": false,
  "formal_acceptance_eligible": false,
  "formal_acceptance_issued": false,
  "pipeline_completed": false,
  "public_release_allowed": false,
  "verification_mode": "cryptographic_agility_inventory_pqc_migration_readiness_and_algorithm_policy_enforcement",

  "policy_scope": {
    "cryptographic_inventory": true,
    "algorithm_identification": true,
    "public_parameter_identification": true,
    "pqc_migration_classification": true,
    "algorithm_policy_enforcement": true,
    "evidence_binding": true,
    "key_material_collection": false,
    "private_key_inspection": false,
    "automatic_key_generation": false,
    "automatic_key_rotation": false,
    "automatic_algorithm_replacement": false
  },

  "inventory_requirements": {
    "unique_asset_id_required": true,
    "asset_type_required": true,
    "purpose_required": true,
    "algorithm_family_required": true,
    "algorithm_identifier_required": true,
    "migration_state_required": true,
    "inventory_confidence_required": true,
    "verification_evidence_required_for_verified_claims": true,
    "unknown_values_must_be_explicit": true,
    "unknown_algorithm_must_not_be_assumed_safe": true,
    "private_key_material_prohibited": true,
    "key_seed_material_prohibited": true,
    "credential_material_prohibited": true,
    "token_material_prohibited": true
  },

  "asset_types": [
    "hash_function",
    "classical_signature",
    "pqc_signature",
    "certificate_public_key",
    "certificate_signature",
    "trusted_timestamp",
    "transparency_log_binding",
    "key_rotation_metadata",
    "revocation_metadata",
    "qkd_evidence_metadata",
    "cryptographic_library",
    "workflow_cryptographic_tooling"
  ],

  "migration_states": [
    "not_inventoried",
    "identified",
    "quantum_vulnerable",
    "migration_planned",
    "hybrid_enabled",
    "hybrid_verified",
    "pqc_primary",
    "classical_fallback_retained",
    "pqc_only",
    "retired",
    "exception_approved",
    "blocked"
  ],

  "inventory_confidence_levels": [
    "declared_unverified",
    "detected_metadata",
    "verified_metadata",
    "verified_execution_evidence"
  ],

  "algorithm_status_values": [
    "allowed",
    "temporarily_allowed",
    "migration_required",
    "prohibited",
    "unknown",
    "evidence_required"
  ],

  "hash_policy": {
    "minimum_required_algorithm": "SHA-256",
    "allowed_algorithms": [
      "SHA-256",
      "SHA-384",
      "SHA-512"
    ],
    "unknown_hash_behavior": "fail_closed"
  },

  "pqc_policy": {
    "recognized_project_algorithm": "ML-DSA-65",
    "verified_claim_requires_execution_evidence": true,
    "hybrid_enabled_is_not_hybrid_verified": true,
    "pqc_component_does_not_imply_entire_system_quantum_safe": true,
    "pqc_only_claim_allowed": false
  },

  "timestamp_policy": {
    "required_timestamp_systems": [
      "RFC3161",
      "OpenTimestamps"
    ],
    "required_verified_proof_count_for_stage377_final_acceptance": 2,
    "pending_timestamp_must_not_be_counted_as_verified": true,
    "timestamp_system_is_not_signature_algorithm": true
  },

  "qkd_policy": {
    "qkd_is_not_public_key_signature_algorithm": true,
    "qkd_metadata_must_be_classified_separately": true,
    "qkd_evidence_must_not_be_used_to_fabricate_pqc_migration_completion": true,
    "raw_qkd_secret_material_publication_allowed": false
  },

  "unknown_algorithm_policy": {
    "required_asset_with_unknown_algorithm": "cryptographic_inventory_incomplete",
    "verified_claim_with_unknown_algorithm": "fail_closed",
    "unknown_algorithm_may_be_assumed_allowed": false,
    "unknown_algorithm_may_be_assumed_quantum_safe": false
  },

  "decision_model": {
    "verified": "cryptographic_agility_profile_verified",
    "migration_required": "pqc_migration_required",
    "inventory_incomplete": "cryptographic_inventory_incomplete",
    "prohibited_algorithm": "prohibited_algorithm_detected",
    "stage384_changed": "stage384_change_requires_reverification",
    "integrity_failure": "fail_closed"
  },

  "stage384_gate": {
    "required_decision": "continuous_trust_state_verified_upstream_pending",
    "required_verification_status": "verified_unchanged_upstream_pending",
    "change_detected_required": false,
    "reverification_required_required": false,
    "eligibility_invalidated_required": false,
    "critical_failure_count_required": 0
  },

  "fail_closed_conditions": [
    "required_file_missing",
    "invalid_json",
    "policy_sha256_mismatch",
    "inventory_sha256_mismatch",
    "stage384_result_sha256_mismatch",
    "stage384_manifest_sha256_mismatch",
    "duplicate_asset_id",
    "conflicting_algorithm_declaration",
    "verified_claim_without_evidence",
    "required_unknown_algorithm",
    "private_key_material_detected",
    "key_seed_material_detected",
    "credential_material_detected",
    "token_material_detected",
    "scope_reduction_detected",
    "fail_closed_disabled"
  ],

  "publication_boundary": {
    "public_algorithm_metadata_allowed": true,
    "public_parameter_metadata_allowed": true,
    "public_migration_state_allowed": true,
    "public_evidence_reference_allowed": true,
    "public_verification_result_allowed": true,
    "private_core_publication_allowed": false,
    "private_directory_publication_allowed": false,
    "private_key_publication_allowed": false,
    "key_seed_publication_allowed": false,
    "secret_publication_allowed": false,
    "credential_publication_allowed": false,
    "token_publication_allowed": false,
    "raw_qkd_key_publication_allowed": false,
    "raw_timestamp_binary_publication_allowed": false
  },

  "preservation_boundary": {
    "stage377_through_stage384_records_are_read_only": true,
    "stage384_baseline_must_not_be_rewritten": true,
    "stage384_result_must_not_be_overwritten": true,
    "stage384_manifest_must_not_be_overwritten": true,
    "stage385_does_not_fabricate_algorithm_evidence": true,
    "stage385_does_not_claim_entire_system_quantum_safe": true,
    "stage385_does_not_upgrade_upstream_formal_acceptance": true
  }
}