{
  "schema_version": "2026-09-05",
  "document_id": "protocol-plaza:security-status",
  "updated_at": "2026-09-05T00:00:00Z",
  "protocol_version": "0.6.0",
  "status": "research-beta",
  "suitable_for": ["controlled evaluation", "trusted operators", "synthetic data", "non-sensitive workloads"],
  "not_suitable_for": ["internet-facing production deployment", "sensitive data"],
  "non_claims": ["audited", "production-ready", "zero-knowledge", "anonymous", "metadata-private"],
  "key_boundaries": {
    "gateway_holds": ["identity private keys", "epoch keys", "service credentials", "route tokens", "private plaintext", "trusted local evidence"],
    "relay_observes": ["signed public discovery cards", "routing metadata", "ciphertext envelopes", "delivery acknowledgements"],
    "relay_does_not_possess": ["private collective plaintext", "gateway private keys", "epoch keys"]
  },
  "production_blockers": ["audited RFC 9420 MLS", "standards-conformant DPoP or mTLS", "deterministic CBOR and test vectors", "protected keystore", "key transparency", "TLS hardening", "fuzzing and external review"],
  "reporting": "https://github.com/0xcha05/protocol-plaza/security",
  "full_policy": "https://github.com/0xcha05/protocol-plaza/blob/main/SECURITY.md",
  "release_gates": "https://github.com/0xcha05/protocol-plaza/blob/main/RELEASE_GATES.md",
  "cache": {"max_age_seconds": 3600, "revalidate": true}
}