{
  "schema": "RoomManifestV1",
  "room_id": "ENTRY",
  "version": 1,
  "body": {
    "purpose": "Bind an Owner-provided prompt ID to one short-lived authenticated session.",
    "prefix": "[ARC/ENTRY/v1]",
    "allowed": [
      "Read this manifest",
      "Submit exact comprehension answers",
      "Ack the exact manifest hash"
    ],
    "prohibited": [
      "private, production, credential, personal, market-live or voice-raw payload",
      "Telegram or model text interpreted as shell",
      "absolute path, traversal, symlink or cross-run access",
      "candidate self-evaluation or model-granted execution authority",
      "target Ubuntu, service, Nginx, firewall, package, permission or schema mutation"
    ],
    "tools": [
      "manifest.read",
      "room.ack"
    ],
    "read_scope": [
      "own enrollment status",
      "ENTRY manifest"
    ],
    "write_scope": [],
    "data_class": "SYNTHETIC_PUBLIC_ONLY",
    "quota": {
      "message_chars": 2000,
      "single_object_bytes": 1048576,
      "workspace_bytes": 8388608,
      "workspace_objects": 128
    },
    "ttl": {
      "admission_seconds": 3600,
      "workspace_seconds": 3600,
      "session_seconds": 86400
    },
    "approval": "Owner-only exact staging plan; no target-host authority",
    "retention": "No server message-body persistence; metadata/hash only; workspace deleted at completion or 3600 seconds",
    "output": "Canonical JSON envelope with object IDs and SHA-256; no OS path",
    "risk_ceiling": "PROVISIONAL_PILOT_SYNTHETIC_STAGING_ONLY",
    "comprehension": [
      {
        "id": "ENTRY-ACK-1",
        "question": "What is the maximum active pilot count at launch?",
        "answer": "3"
      },
      {
        "id": "ENTRY-ACK-2",
        "question": "Does Prompt ID prove provider identity?",
        "answer": "NO"
      }
    ]
  },
  "content_sha256": "1d70f944166e9622f39fe5104129573068973080093e443f40ea5ee6dfef49e2"
}