{
 "note": "Security rules (docs/tech/SECURITY_ANTICHEAT.md). Gameplay code only reports security events; this rule engine decides. Bans are automatic; humans review only appeals (Contact us). All thresholds proposed.",
 "proposed": true,
 "tiers": {
  "certain": {
   "meaning": "impossible from an unmodified client",
   "action": "permanent_ban",
   "rollback": true
  },
  "strong": {
   "meaning": "very unlikely for a human, measured over time",
   "action": "temporary_restriction",
   "repeatWithinDays": 30,
   "repeatAction": "permanent_ban",
   "rollback": true
  },
  "watch": {
   "meaning": "unusual but can be legitimate",
   "action": "none",
   "rollback": false
  }
 },
 "ladder": [
  "warn",
  "kick",
  "mute_or_trade_lock",
  "suspend_24h",
  "suspend_7d",
  "permanent_ban"
 ],
 "rules": [
  {
   "id": "proto_forged",
   "tier": "certain",
   "what": "Forged or malformed protocol message (schema/bit-packing violation, impossible field values)",
   "evidence": "message summary + connection id"
  },
  {
   "id": "token_replay",
   "tier": "certain",
   "what": "Replayed or foreign session/admission token",
   "evidence": "token id, both connections"
  },
  {
   "id": "foreign_entity",
   "tier": "certain",
   "what": "Command issued for an entity the session does not own",
   "evidence": "entity ids"
  },
  {
   "id": "speed_repeat",
   "tier": "certain",
   "what": "Movement beyond physics repeated after server corrections (≥ 5 corrections over 2× max speed in 60 s)",
   "evidence": "positions, corrections, speeds"
  },
  {
   "id": "client_integrity",
   "tier": "certain",
   "what": "Client build hash does not match any released build",
   "evidence": "reported hash, version"
  },
  {
   "id": "dupe_race",
   "tier": "certain",
   "what": "Repeated concurrent item/gold transactions on the same receipt (≥ 3 in 10 s)",
   "evidence": "receipt ids"
  },
  {
   "id": "bot_timing",
   "tier": "strong",
   "what": "Input timing variance below human range for 2+ h outside official automation",
   "evidence": "input timing histogram"
  },
  {
   "id": "no_breaks_manual",
   "tier": "strong",
   "what": "Manual-mode play 20+ h in 24 h without breaks",
   "evidence": "session timeline"
  },
  {
   "id": "rmt_funnel",
   "tier": "strong",
   "what": "Gold/items funnelled between unrelated accounts above the trade pattern threshold",
   "evidence": "trade graph + receipts"
  },
  {
   "id": "chat_spam",
   "tier": "strong",
   "what": "Repeated link/advert messages across channels",
   "evidence": "messages"
  },
  {
   "id": "fast_level",
   "tier": "watch",
   "what": "Levelling faster than the 99th percentile for the ruleset",
   "evidence": "xp timeline"
  },
  {
   "id": "drop_streak",
   "tier": "watch",
   "what": "Rare-drop streak beyond the expected distribution",
   "evidence": "drop receipts"
  },
  {
   "id": "multi_account_device",
   "tier": "watch",
   "what": "Many accounts on one device",
   "evidence": "device id, accounts"
  }
 ],
 "appeal": {
  "entry": "Ban screen and site Support → Contact us → Ban review (ban id prefilled)",
  "reviewOnlyWhenAppealed": true,
  "reviewWithinDays": 7,
  "outcomes": [
   "upheld",
   "reduced",
   "reversed"
  ],
  "reversalRestoresReceipts": true
 },
 "ruleQuality": {
  "maxReversalRate": 0.02,
  "windowDays": 30,
  "onExceed": "demote one tier + alert",
  "newRuleShadowDays": 14
 },
 "eventLog": {
  "retentionDays": 180,
  "public": false
 },
 "tests": [
  "red team: forged packets, token replay, speed hack, dupe race → expected events + bans, no duplication",
  "false positives: 1,000 legitimate bots + Auto-Hunt/Auto-Quest/offline actors for 60 min → zero bans and zero restrictions"
 ]
}