{
  "comment": [
    "Gate 4. Hosts a sibling client belonging to team `acme` must refuse,",
    "and the one it must reach. Doctrine §4.1.",
    "",
    "The gate counts connections, not errors: a refused host must cost zero",
    "connection attempts. The redirect case is the exception the doctrine",
    "calls out — a client has to reach an allowed host to be told to",
    "redirect, so what is forbidden there is the follow-up hop."
  ],

  "team": "acme",

  "refuse": [
    { "host": "acme-evil.docs.oficina.works", "why": "a different team label that merely starts with ours" },
    { "host": "acmex.docs.oficina.works", "why": "a longer label with ours as a prefix" },
    { "host": "acme.docs.oficina.works.evil", "why": "in evil, not in oficina.works, despite reading like it" },
    { "host": "evil.com", "why": "outside the suite domain entirely" },
    { "host": "docs.oficina.works", "why": "no team label at all" },
    { "host": "acme.team.docs.oficina.works", "why": "an extra label between team and app" },
    { "host": "ACME-EVIL.docs.oficina.works", "why": "case must not smuggle a different label through" },
    { "host": "acme..oficina.works", "why": "an empty app label counts as two labels but names no app" },
    { "host": "acme.-docs.oficina.works", "why": "a label may not begin with a hyphen" },
    { "host": "acme.docs-.oficina.works", "why": "a label may not end with a hyphen" },
    { "host": "acme.docs_.oficina.works", "why": "underscore is not a hostname character" },
    { "host": "acme.docs。evil.oficina.works", "why": "an ideographic full stop is not a label separator here, and IDNA normalisation could turn it into one later" },
    { "host": ".docs.oficina.works", "why": "an empty team label" }
  ],

  "reach": [
    { "host": "acme.docs.oficina.works", "why": "our own team's Docs instance" },
    { "host": "acme.sheets.oficina.works", "why": "our own team's Sheets instance" },
    { "host": "acme.docs.oficina.works.", "why": "a fully-qualified trailing dot is the same host, and normalising it is the check's job — refusing it would break a legitimate caller" },
    { "host": "ACME.docs.oficina.works", "why": "hostnames are case-insensitive; our own host shouted is still ours" }
  ],

  "redirect": {
    "from": "acme.docs.oficina.works",
    "to": "acme-evil.docs.oficina.works",
    "why": "the first hop is legitimate; following the redirect is not"
  }
}