{
  "format": 1,
  "seat": "node-packet-filter",
  "scope": "node",
  "grain": "seat-list",
  "decision": "novox/hq ADR 0121",
  "verbs": [
    {
      "name": "rules",
      "description": "The packet filter as this machine enforces it now: the nftables ruleset and, where the tool exists, the legacy filter's listings. Narrowed to one table or chain when asked.",
      "replaces": [
        "nft list ruleset",
        "iptables -L",
        "iptables-save"
      ],
      "input": {
        "properties": {
          "chain": {
            "description": "one chain of that table (optional)",
            "type": "string"
          },
          "table": {
            "description": "one nftables table, as `family name` (optional)",
            "type": "string"
          }
        },
        "type": "object"
      }
    },
    {
      "name": "reload",
      "description": "Load the mesh's own filter again from the file the mesh writes, and answer with the mesh's table as loaded.",
      "replaces": [
        "nft -f"
      ],
      "input": {
        "properties": {},
        "type": "object"
      }
    },
    {
      "name": "remove",
      "description": "Remove one rule set the mesh did not write, named exactly as the host reports it (novox/hq ADR 0168) — `chain X (iptables-legacy)` or `table ip6 filter, chain DOCKER-USER`. Refuses the mesh's tables, the runtime's own chains, a built-in chain and an active found firewall's chains. An operator's act, by name, never a flush.",
      "replaces": [
        "nft delete",
        "iptables -X"
      ],
      "input": {
        "properties": {
          "where": {
            "description": "the rule set, as `node show` lists it",
            "type": "string"
          }
        },
        "required": [
          "where"
        ],
        "type": "object"
      }
    }
  ]
}