StellaOps:
  Crypto:
    Registry:
      ActiveProfile: kr-kcmvp-hash
      PreferredProviders:
        - kr.kcmvp.hash
        - default
      Profiles:
        kr-kcmvp-hash:
          PreferredProviders:
            - kr.kcmvp.hash
            - default
    Diagnostics:
      Providers:
        Enabled: true
        Metrics:
          LogLevel: Information
    Notes:
      Certification: "hash-only baseline (SHA-256). Set KCMVP_HASH_ALLOWED=1 to enable."