diff --git a/MODULE_SPEC.yaml b/MODULE_SPEC.yaml
new file mode 100644
index 0000000..4d9dad0
--- /dev/null
+++ b/MODULE_SPEC.yaml
@@ -0,0 +1,120 @@
+{
+  "schema_version": 1,
+  "module_id": "vpn-rules",
+  "authority": {
+    "scope": "module_metadata",
+    "subject": "vpn-rules",
+    "owner": "vpn-rules-owner",
+    "source": "MODULE_SPEC.yaml",
+    "revision": 1,
+    "effective_from": "2026-08-20T00:00:00+08:00"
+  },
+  "repository": {
+    "name": "vpn-rules",
+    "workspace_id": null,
+    "type": "infrastructure",
+    "maturity": "operational"
+  },
+  "bounded_context": {
+    "domain": "network-routing-policy",
+    "responsibility": "Own the single source of truth for direct-routing rules and deterministic projections for supported clients.",
+    "prohibited_responsibilities": [
+      "Applying rules to production clients, routers, VPN services, or proxy runtimes",
+      "Owning or exposing proxy subscription credentials, provider tokens, or device secrets",
+      "Claiming generated or checked-in artifacts are active production configuration"
+    ]
+  },
+  "capabilities": [
+    {
+      "id": "direct-routing-rule-authoring",
+      "summary": "Maintain provider-neutral direct-routing entries in the authoritative mihomo rule-provider source.",
+      "status": "operational"
+    },
+    {
+      "id": "clash-verge-script-generation",
+      "summary": "Render source entries as idempotent DIRECT rules for Clash Verge Script.js.",
+      "status": "operational"
+    },
+    {
+      "id": "router-rule-projection",
+      "summary": "Generate policy-bearing YAML and policy-free plain-text projections for router consumers.",
+      "status": "operational"
+    }
+  ],
+  "data": {
+    "owns": [
+      {
+        "asset_id": "direct-routing-rule-source",
+        "kind": "reference",
+        "classification": "restricted"
+      },
+      {
+        "asset_id": "generated-router-rule-projections",
+        "kind": "artifact",
+        "classification": "restricted"
+      }
+    ]
+  },
+  "contracts": {
+    "provides": [
+      {
+        "contract_id": "mihomo-direct-rule-provider",
+        "kind": "artifact",
+        "version": "1.0.0",
+        "path": "direct.yaml",
+        "compatibility": "backward"
+      },
+      {
+        "contract_id": "router-direct-rules",
+        "kind": "artifact",
+        "version": "1.0.0",
+        "path": "router/direct-rules.yaml",
+        "compatibility": "exact"
+      },
+      {
+        "contract_id": "router-direct-plain-list",
+        "kind": "artifact",
+        "version": "1.0.0",
+        "path": "router/direct-plain.txt",
+        "compatibility": "exact"
+      }
+    ],
+    "consumes": []
+  },
+  "dependencies": [],
+  "agent_context": {
+    "default_entrypoints": [
+      {
+        "path": "README.md",
+        "purpose": "Repository purpose, supported consumers, generation commands, and maintenance flow."
+      },
+      {
+        "path": "direct.yaml",
+        "purpose": "Authoritative direct-routing rule source and provider format."
+      }
+    ],
+    "excluded_paths": [
+      "router"
+    ],
+    "max_default_tokens": 6000
+  },
+  "verification": {
+    "commands": [
+      {
+        "id": "rule-contract-tests",
+        "argv": [
+          "python3",
+          "-m",
+          "unittest",
+          "discover",
+          "-s",
+          "tests",
+          "-v"
+        ],
+        "cwd": ".",
+        "network": false,
+        "required": true
+      }
+    ]
+  }
+}