// Governed Forge policy. Clause IDs are stable SOURCE names.
CONTRACT ForgeTokenCustody {
  ENFORCEMENT_MODE: enforced
  CONTEXT {
    ENTITIES TokenRequest {
      repo_role: string
      scope: string
      requester: string
      ttl_seconds: int
    }
    CONSTANTS {
      zero: int == 0 [SOURCE:FORGE-POLICY-V1]
      main_write_ttl_max: int == 120 [SOURCE:FORGE-POLICY-V1]
      other_ttl_max: int == 7200 [SOURCE:FORGE-POLICY-V1]
      bootstrap_fork_ttl_max: int == 86400 [SOURCE:FORGE-POLICY-V1]
    }
  }
  TRIGGER {
    mint_token()
    bootstrap_fork_token()
  }
  PROHIBITION {
    FORBID mint_token WHEN TokenRequest.repo_role != "main" AND TokenRequest.repo_role != "fork" AND TokenRequest.repo_role != "holdout" [SOURCE:token_unknown_role]
    FORBID mint_token WHEN TokenRequest.scope != "read" AND TokenRequest.scope != "write" [SOURCE:token_unknown_scope]
    FORBID mint_token WHEN TokenRequest.requester != "agent" AND TokenRequest.requester != "human" AND TokenRequest.requester != "governor" AND TokenRequest.requester != "harness" AND TokenRequest.requester != "system" [SOURCE:token_unknown_requester]
    FORBID mint_token WHEN TokenRequest.ttl_seconds <= zero [SOURCE:token_positive_ttl]
    FORBID mint_token WHEN TokenRequest.repo_role == "main" AND TokenRequest.scope == "write" AND TokenRequest.requester != "governor" [SOURCE:token_main_writer]
    FORBID mint_token WHEN TokenRequest.repo_role == "main" AND TokenRequest.scope == "write" AND TokenRequest.ttl_seconds > main_write_ttl_max [SOURCE:token_main_ttl]
    FORBID mint_token WHEN (TokenRequest.repo_role != "main" OR TokenRequest.scope != "write") AND TokenRequest.ttl_seconds > other_ttl_max [SOURCE:token_other_ttl]
    FORBID mint_token WHEN TokenRequest.repo_role == "holdout" AND TokenRequest.requester != "harness" [SOURCE:token_holdout_harness]
    FORBID mint_token WHEN TokenRequest.repo_role == "holdout" AND TokenRequest.scope != "read" [SOURCE:token_holdout_read]
    // Implicit vendor fork credential: governor custody only, revoked before provisioning.
    FORBID bootstrap_fork_token WHEN TokenRequest.repo_role != "fork" [SOURCE:bootstrap_fork_role]
    FORBID bootstrap_fork_token WHEN TokenRequest.scope != "write" [SOURCE:bootstrap_fork_scope]
    FORBID bootstrap_fork_token WHEN TokenRequest.requester != "governor" [SOURCE:bootstrap_fork_governor]
    FORBID bootstrap_fork_token WHEN TokenRequest.ttl_seconds <= zero [SOURCE:bootstrap_fork_positive_ttl]
    FORBID bootstrap_fork_token WHEN TokenRequest.ttl_seconds > bootstrap_fork_ttl_max [SOURCE:bootstrap_fork_ttl]
  }
  OBSERVABILITY {
    LOG "ForgeTokenCustody evaluated" ON decision
  }
}