schema = 1
levels = ["V1", "V2", "V3", "V4", "V5"]

[[command]]
id = "python"
program = "python3"
args = ["--version"]
version_pattern = '^Python 3\.(1[1-9]|[2-9][0-9])\.'
policy = "fail"
levels = ["V1", "V2", "V3", "V4", "V5"]
diagnostic = "Python 3.11 or newer is required for repository verification."

[[command]]
id = "rustc"
program = "rustc"
args = ["--version"]
version_pattern = '^rustc 1\.90\.0 '
policy = "fail"
levels = ["V1", "V2", "V3", "V4", "V5"]
diagnostic = "Install the pinned Rust toolchain from rust-toolchain.toml."

[[command]]
id = "cargo"
program = "cargo"
args = ["--version"]
version_pattern = '^cargo 1\.90\.0 '
policy = "fail"
levels = ["V1", "V2", "V3", "V4", "V5"]
diagnostic = "Install the pinned Rust toolchain from rust-toolchain.toml."

[[command]]
id = "cargo-deny"
program = "cargo-deny"
args = ["--version"]
version_pattern = '^cargo-deny 0\.20\.2$'
policy = "fail"
levels = ["V1", "V2", "V3", "V4", "V5"]
diagnostic = "Install cargo-deny 0.20.2 with its locked dependency graph."

[[command]]
id = "git"
program = "git"
args = ["--version"]
version_pattern = '^git version 2\.'
policy = "fail"
levels = ["V1", "V2", "V3", "V4", "V5"]
diagnostic = "Git 2.x is required for generated-file drift checks."

[[command]]
id = "tlc"
program = "tlc"
args = ["-h"]
version_pattern = 'Version 2\.19 '
accepted_exit_codes = [0, 1]
policy = "fail"
levels = ["V1", "V2", "V3", "V4", "V5"]
diagnostic = "Install the TLC 2.19 launcher on PATH."

[[command]]
id = "runsc"
program = "runsc"
args = ["--version"]
version_pattern = '^runsc version release-20260622\.0\nspec: 1\.2\.1$'
policy = "skip"
levels = ["V3", "V4", "V5"]
diagnostic = "The selected composition is qualified on runsc release-20260622.0."

[[command]]
id = "fuse-overlayfs"
program = "fuse-overlayfs"
args = ["--version"]
version_pattern = '^fusermount3 version: 3\.18\.2\nfuse-overlayfs: version 1\.16\nFUSE library version 3\.18\.2\nusing FUSE kernel interface version 7\.45$'
policy = "skip"
levels = ["V2", "V3", "V4", "V5"]
diagnostic = "Install the qualified fuse-overlayfs 1.16 and FUSE 3.18.2 stack."

[[command]]
id = "slirp4netns"
program = "slirp4netns"
args = ["--version"]
version_pattern = '^slirp4netns version 1\.3\.1\ncommit: .+\nlibslirp: 4\.9\.1\nSLIRP_CONFIG_VERSION_MAX: 6\nlibseccomp: 2\.6\.0$'
policy = "skip"
levels = ["V2", "V3", "V4", "V5"]
diagnostic = "Install the qualified slirp4netns 1.3.1 and libslirp 4.9.1 stack."

[[feature]]
id = "linux-x86_64"
probe = "linux-x86_64"
policy = "skip"
levels = ["V2", "V3", "V4", "V5"]
diagnostic = "Physical and composition suites currently support Linux x86_64."

[[feature]]
id = "kernel"
probe = "kernel-at-least"
minimum = "6.8"
policy = "skip"
levels = ["V2", "V3", "V4", "V5"]
diagnostic = "Linux 6.8 or newer supplies the qualified namespace and pidfd baseline."

[[feature]]
id = "user-namespaces"
probe = "user-namespace"
program = "unshare"
sysctl_path = "/proc/sys/user/max_user_namespaces"
policy = "skip"
levels = ["V2", "V3", "V4", "V5"]
diagnostic = "Enable functional unprivileged user namespace creation for physical runtime tests."

[[feature]]
id = "subordinate-ids"
probe = "subordinate-ids"
minimum_count = 65536
uidmap_program = "newuidmap"
gidmap_program = "newgidmap"
unshare_program = "unshare"
policy = "skip"
levels = ["V2", "V3", "V4", "V5"]
diagnostic = "Configure usable 65,536-ID subordinate UID/GID ranges and mapping helpers for the current user."

[[feature]]
id = "fuse-device"
probe = "open-character-device"
path = "/dev/fuse"
access = "read-write"
policy = "skip"
levels = ["V2", "V3", "V4", "V5"]
diagnostic = "Expose an openable read-write /dev/fuse device to run physical filesystem suites."