{
  "canon_meta": {
    "canon_id": "devon-app-security-canonical",
    "version": "2.0.0",
    "status": "PLANNED",
    "domain": "app_security",
    "master_authority": "master_architecture_index.md",
    "preserve_original_content": true,
    "canonical_layer_key": "trust_layer",
    "phase_origin": [
      "phase-08"
    ],
    "installation_order": 15,
    "primary_stage": "foundations_security"
  },
  "objective": "Define the canonical application security baseline for Devon surfaces.",
  "scope": [
    "input_validation",
    "authn_authz",
    "session_boundary",
    "error_handling",
    "secret_consumption",
    "secure_defaults"
  ],
  "evidence_model": [
    "auth_boundary_contract",
    "input_validation_rules",
    "secret_usage_contract",
    "error_state_policy"
  ],
  "approval_gate": [
    "app_controls_defined",
    "reviewed_against_contracts",
    "application_policy_approved"
  ],
  "governance_reference": {
    "master_authority": "master_architecture_index.md",
    "primary_axis": "canonical_layer",
    "secondary_axis": "deployment_order",
    "preserve_phase_registry": true,
    "preserve_original_content": true
  },
  "canonical_layer_key": "trust_layer",
  "phase_origin": [
    "phase-08"
  ],
  "installation_order": 15,
  "primary_stage": "foundations_security",
  "security_governance_extensions": {
    "canonical_position": {
      "canonical_layer_key": "trust_layer",
      "phase_origin": [
        "phase-08"
      ],
      "installation_order": 15
    },
    "security_stage_group": "foundations_security"
  }
}