{
  "interface": "railiance.custody-projection-contract",
  "version": 1,
  "workplan_id": "RAILIANCE-WP-0025",
  "engagement_id": "REPLACE-WITH-NEW-TERMINAL-UNIQUE-ID",
  "status": "replace-with-explicit-approval",
  "engagement_contract_sha256": "replace-with-64-lowercase-hex",
  "target": {
    "id": "replace-with-target-id",
    "namespace": "replace-with-target-namespace",
    "deployment": "replace-with-target-deployment",
    "container": "replace-with-target-container",
    "sender_external_secret": "replace-with-sender-external-secret",
    "revision": "replace-with-full-40-character-git-revision",
    "image_digest": "sha256:replace-with-64-lowercase-hex",
    "contract_sha256": "replace-with-64-lowercase-hex"
  },
  "runner": {
    "namespace": "whitehat",
    "service_account": "whitehat-runner",
    "secret_name": "replace-with-exact-mounted-secret-name",
    "mount_root": "/var/run/secrets/whitehat",
    "manifest_sha256": "replace-with-64-lowercase-hex"
  },
  "window": {
    "starts_at": "replace-with-RFC3339-start",
    "projection_cutoff": "replace-with-RFC3339-projection-cutoff",
    "expires_at": "replace-with-RFC3339-expiry-at-most-900-seconds-after-start"
  },
  "authority": {
    "remote": "railiance01",
    "registry_path": "replace-with-exact-platform-registry-path",
    "registry_field": "senders.json",
    "kv_mount": "platform",
    "kv_prefix": "engagements/REPLACE-WITH-NEW-TERMINAL-UNIQUE-ID/replace-with-target-id",
    "eso_service_account": "external-secrets",
    "eso_namespace": "external-secrets"
  },
  "identities": [
    {
      "handle": "token-a",
      "role": "attacker",
      "sender_name": "replace-with-new-attacker-sender",
      "tenant": "replace-with-new-attacker-fixture-tenant",
      "mount_path": "/var/run/secrets/whitehat/token-a",
      "may_read": true,
      "may_write": true
    },
    {
      "handle": "token-b",
      "role": "owner",
      "sender_name": "replace-with-new-owner-sender",
      "tenant": "replace-with-new-owner-fixture-tenant",
      "mount_path": "/var/run/secrets/whitehat/token-b",
      "may_read": true,
      "may_write": true
    }
  ]
}