{"ok":true,"checkedAt":"2026-07-17T20:53:50.015Z","contractVersion":"moral-trade-anti-enumeration-v0.1-2026-06","purpose":"Public fail-closed contract for discovery anti-enumeration policy, query/access event logging, bucketed results, sparse-result suppression, timing-equalized responses, and repeated-probe audits across Moral Trade search, browse, preview, invite, match-candidate, and transparency surfaces.","validation":{"status":"pass","validatorName":"moral-trade-anti-enumeration-contract","validatorVersion":"moral-trade-anti-enumeration-validator-v0.1","contractVersion":"moral-trade-anti-enumeration-v0.1-2026-06","checks":[{"id":"first-class-records","label":"Anti-enumeration policy, access events, and probe audits are first-class records","status":"pass","evidence":"moral_trade_anti_enumeration_policies, moral_trade_discovery_access_events, moral_trade_discovery_probe_audits"},{"id":"policy-subjects","label":"Policy snapshots cover anti-enumeration","status":"pass","evidence":"anti_enumeration"},{"id":"surface-coverage","label":"All discovery surfaces are covered","status":"pass","evidence":"public_search, signed_in_search, public_browse, preview_generation, invite_link_creation, match_candidate_browsing, transparency_report"},{"id":"count-buckets","label":"Count buckets prevent exact sparse result exposure","status":"pass","evidence":"zero, one_or_two_suppressed, three_to_nine, ten_to_forty_nine, fifty_plus, not_returned"},{"id":"fail-closed-statuses","label":"Fail-closed statuses cover probing, logging, sparse, timing, and audit blockers","status":"pass","evidence":"policy_missing, policy_mutable, policy_stale, policy_superseded, access_event_missing, access_event_stale, access_event_superseded, query_fingerprint_missing, raw_query_logged, exact_result_count_exposed, bucketed_result_count_missing, sparse_suppression_missing, timing_equalization_missing, rate_limit_missing, repeated_probe_budget_exceeded, audit_missing, audit_failed, audit_stale, incident_escalation_missing, invalid_policy_hash, invalid_event_hash, invalid_audit_hash"},{"id":"sample-evaluations","label":"Sample evaluations prove pass and blocked states","status":"pass","evidence":"public_search:pass, invite_link_creation:blocked"},{"id":"privacy-rule","label":"Privacy rule excludes raw query text and exact hidden counts","status":"pass","evidence":"Anti-enumeration records store stable query fingerprints, actor hashes, buckets, suppression flags, and audit hashes only. They must not expose raw query text, exact hidden result counts, private wishes, rare clusters, exact constraints, contact details, or reviewer notes on public contract surfaces."},{"id":"contract-tests","label":"Contract test hooks are named","status":"pass","evidence":"anti_enumeration_contract_validator, anti_enumeration_evaluator_fail_closed, anti_enumeration_route_contract, anti_enumeration_schema_contract, anti_enumeration_health_contract"}],"blockers":[]},"publicContract":{"privacyRule":"Anti-enumeration records store stable query fingerprints, actor hashes, buckets, suppression flags, and audit hashes only. They must not expose raw query text, exact hidden result counts, private wishes, rare clusters, exact constraints, contact details, or reviewer notes on public contract surfaces.","failClosedRule":"Repeated discovery is not an oracle: missing frozen policy, missing discovery_access_event records, raw query logging, exact result-count exposure, missing sparse suppression, missing timing equalization, missing rate limits, repeated-probe budget failures, or missing probe audits block discovery surfaces before they can reveal rare offers, hidden constraints, exact willingness-to-pay, or private counterparty attributes.","firstClassRecordTables":["moral_trade_anti_enumeration_policies","moral_trade_discovery_access_events","moral_trade_discovery_probe_audits"],"policySnapshotSubjects":["anti_enumeration"],"surfaces":["public_search","signed_in_search","public_browse","preview_generation","invite_link_creation","match_candidate_browsing","transparency_report"],"countBuckets":["zero","one_or_two_suppressed","three_to_nine","ten_to_forty_nine","fifty_plus","not_returned"],"failClosedStatuses":["policy_missing","policy_mutable","policy_stale","policy_superseded","access_event_missing","access_event_stale","access_event_superseded","query_fingerprint_missing","raw_query_logged","exact_result_count_exposed","bucketed_result_count_missing","sparse_suppression_missing","timing_equalization_missing","rate_limit_missing","repeated_probe_budget_exceeded","audit_missing","audit_failed","audit_stale","incident_escalation_missing","invalid_policy_hash","invalid_event_hash","invalid_audit_hash"],"surfaceDefinitions":[{"key":"public_search","protectedInference":"hidden offers, rare cause clusters, and zero-count sensitive facets","requiredControls":["frozen_anti_enumeration_policy","stable_query_fingerprint","rate_limit_budget","discovery_access_event_log","bucketed_result_count","sparse_result_suppression","timing_equalized_response","probe_audit"],"blocksTransitions":["public_offer_search_result","public_offer_facet_publication"]},{"key":"signed_in_search","protectedInference":"private constraints, exact wishes, and same-owner probing pressure","requiredControls":["frozen_anti_enumeration_policy","stable_query_fingerprint","rate_limit_budget","discovery_access_event_log","bucketed_result_count","sparse_result_suppression","timing_equalized_response","probe_audit"],"blocksTransitions":["wish_registry_result","saved_search_recommendation"]},{"key":"public_browse","protectedInference":"rare view clusters and sparse public marketplace slices","requiredControls":["frozen_anti_enumeration_policy","stable_query_fingerprint","rate_limit_budget","discovery_access_event_log","bucketed_result_count","sparse_result_suppression","timing_equalized_response","probe_audit"],"blocksTransitions":["public_browse_result","facet_count_publication"]},{"key":"preview_generation","protectedInference":"exact willingness-to-pay, hidden constraints, and preview-only matches","requiredControls":["frozen_anti_enumeration_policy","stable_query_fingerprint","rate_limit_budget","discovery_access_event_log","bucketed_result_count","sparse_result_suppression","timing_equalized_response","probe_audit"],"blocksTransitions":["round_preview","donation_offset_preview","pledge_swap_preview"]},{"key":"invite_link_creation","protectedInference":"private target availability and repeated solicitation pressure","requiredControls":["frozen_anti_enumeration_policy","stable_query_fingerprint","rate_limit_budget","discovery_access_event_log","bucketed_result_count","sparse_result_suppression","timing_equalized_response","probe_audit"],"blocksTransitions":["invite_link_publication","contact_introduction_candidate"]},{"key":"match_candidate_browsing","protectedInference":"counterparty attributes, private willingness, and rare hidden matches","requiredControls":["frozen_anti_enumeration_policy","stable_query_fingerprint","rate_limit_budget","discovery_access_event_log","bucketed_result_count","sparse_result_suppression","timing_equalized_response","probe_audit"],"blocksTransitions":["match_candidate_preview","matched_trade_lock_candidate"]},{"key":"transparency_report","protectedInference":"small cells, rare stances, and jurisdiction/cause-area slices","requiredControls":["frozen_anti_enumeration_policy","stable_query_fingerprint","rate_limit_budget","discovery_access_event_log","bucketed_result_count","sparse_result_suppression","timing_equalized_response","probe_audit"],"blocksTransitions":["public_metric_publication","transparency_slice_publication"]}],"antiEnumerationSampleEvaluationStatuses":{"public_search":"pass","invite_link_creation":"blocked"},"contractTests":["anti_enumeration_contract_validator","anti_enumeration_evaluator_fail_closed","anti_enumeration_route_contract","anti_enumeration_schema_contract","anti_enumeration_health_contract"]},"blockers":[]}