{
  "schema_version": "log-salad-public-capabilities-v1",
  "contract_version": "console-v1",
  "source_revision": "23fdccfaa88f69e858769f1dad70f82739e2740f",
  "stage": "private_evaluation",
  "qualification": "integration_verification_pending",
  "api": "/docs/console-v1/openapi.json",
  "supported_candidates": [
    "same_origin_cookie_sessions",
    "gated_isolated_evaluation_signup",
    "scoped_source_tokens",
    "native_partial_ocsf_mapping",
    "bounded_hot_filters_sql_preview",
    "bounded_pyiceberg_history_time_source_filters",
    "stateless_scalar_sigma_subset",
    "deterministic_evidence_narratives",
    "local_console_outbox",
    "versioned_cases",
    "human_approved_local_case_workflows",
    "operator_cost_snapshot"
  ],
  "planned_or_unqualified": [
    "production_ha",
    "production_sso",
    "generated_full_ocsf_coverage",
    "stateful_sigma_windows_correlation",
    "presto_trino",
    "advanced_sql_editor",
    "oauth_self_service",
    "external_ticket_delivery",
    "cloud_containment",
    "system_one_advisory",
    "budget_communications",
    "production_retention_holds_recovery"
  ],
  "not_supported": [
    "unrestricted_sql",
    "model_authorized_actions",
    "arbitrary_scripts",
    "arbitrary_network_actions",
    "cross_workspace_access"
  ],
  "inference": {
    "status": "disabled",
    "delivery_independent": true,
    "action_authority": false
  },
  "source_kinds": {
    "aws_cloudtrail": "CreateAccessKey with required response evidence only",
    "google_workspace": "login_failure, login_success, Drive download; one activity per native record",
    "cloudwatch_sample_service": "synthetic auth.login denied; numeric schema_version:1; configured log groups; no actor/sensitive audit payload"
  },
  "limits": {
    "request_bytes": 8388608,
    "ingest_records": 1000,
    "query_rows": 500,
    "query_range_days": 31,
    "hot_query_engine_seconds": 5,
    "hot_query_memory_bytes": 268435456,
    "hot_query_read_bytes": 67108864,
    "query_text_utf8_bytes": 256,
    "evaluation_workspaces": 32,
    "signup_username_ascii_bytes": [
      3,
      64
    ],
    "signup_password_utf8_bytes": [
      12,
      128
    ],
    "workspace_name_utf8_bytes": 128,
    "tenant_unique_events": 10000,
    "tenant_raw_batches": 10000,
    "tenant_retained_request_bytes": 268435456,
    "workflow_steps": [
      1,
      20
    ],
    "plan_expiry_seconds": 600,
    "session_seconds": 28800,
    "shared_auth_attempts_per_minute": 20
  },
  "history_filters": [
    "start_time_ms",
    "end_time_ms",
    "source_id",
    "limit"
  ],
  "source_acknowledgement": "Poll operation until committed; 202 alone is not sink completion",
  "costs": {
    "default": "unavailable",
    "provenance_labels": [
      "estimated",
      "observed",
      "billed",
      "unavailable"
    ],
    "provider_billing_calls": false,
    "budget_communications": "not_connected"
  },
  "publication": "Curated public docs only; no internal runbooks, provider records, credentials or repository-root export."
}