diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6ec7156..30006b3 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,9 @@
 
 ## 0.1.0 — Unreleased
 
+- Vendor five OpenBSD TALs and constraints with pinned provenance; enable policies
+  in both all5 Compose examples and add the TOML `ta-constraints-enabled` switch.
+  Validation summaries identify applied policies.
 - Breaking CLI change: mandatory TOML via `validate|daemon --config FILE`;
   remove business flags, `--` forwarding and logging environment overrides.
 - Read-only configuration checking/printing and top-level version output.
diff --git a/README.md b/README.md
index 6cd9f11..12de371 100644
--- a/README.md
+++ b/README.md
@@ -1,25 +1,25 @@
 # Panda RPKI
 
-For every field, default, constraint and complete example, see the [TOML configuration reference](docs/configuration.md)。
-
 Panda RPKI is an RPKI relying party written in Rust. It synchronizes repositories
 over RRDP, validates signed objects, and exports routing data as CSV and Canonical
 Cache Representation (CCR). Run a single cycle or use the daemon for continuous operation.
 
-Version 0.1.0 is an unreleased candidate, validated on Linux x86-64. Other
-platforms are not yet verified. Review the [standards and limitations](docs/conformance-matrix.md)
-and [security policy](SECURITY.md) before evaluating it for routing use.
+Configuration is provided through TOML. See the [TOML configuration reference](docs/configuration.md)
+for every field, default, constraint and complete example.
+
+This build is validated on Linux x86-64. Other platforms are not yet verified.
+Review the [standards and limitations](docs/conformance-matrix.md) and [security
+policy](SECURITY.md) before evaluating it for routing use.
 
 ## Quick start
 
-Requirements: Linux, Docker, and a TAL. A matching DER trust-anchor certificate
-may be supplied in the TOML, or Panda can refresh it from the TAL's URI. Follow
-[input preparation](docs/getting-started.md#prepare-trust-anchors) for trusted
-RIR inputs. From the project root, after placing `input/anchor.tal` (and, for a
-fixed-TA run, `input/anchor.cer`):
+Requirements: Linux and Docker. This repository includes a pinned AFRINIC TAL and
+its constraints under `tals/`, so no TAL download or `input/` setup is needed for
+this first run. A matching DER trust-anchor certificate may be supplied in the
+TOML, or Panda can refresh it from the TAL's URI. From the project root:
 
 ```bash
-docker build -f docker/Dockerfile -t panda-rpki:v0.1.0 .
+docker build -f docker/Dockerfile -t panda-rpki:local .
 mkdir -p state output
 cat > validate.toml <<'TOML'
 config-version = 1
@@ -29,22 +29,26 @@ rrdp-state-dir = "/state/repository"
 ccr-out = "/output/result.ccr"
 
 [[anchors]]
-id = "anchor"
-tal = "/input/anchor.tal"
-# ta = "/input/anchor.cer" # uncomment for fixed TA mode
+id = "afrinic"
+tal = "/input/afrinic.tal"
+constraints = "/input/afrinic.constraints"
+# ta = "/input/afrinic.cer" # uncomment for fixed TA mode
 TOML
 docker run --rm --read-only --tmpfs /tmp \
   --user "$(id -u):$(id -g)" \
-  -v "$PWD/input:/input:ro" \
+  -v "$PWD/tals:/input:ro" \
   -v "$PWD/state:/state" \
   -v "$PWD/output:/output" \
   -v "$PWD/validate.toml:/config/validate.toml:ro" \
-  panda-rpki:v0.1.0 validate --config /config/validate.toml
+  panda-rpki:local validate --config /config/validate.toml
 ```
 
 The quick start refreshes the TA certificate automatically; TAL files themselves
 remain operator-maintained. For complete single/all-five and daemon TOML files,
-see [Compose examples](docker/examples/README.md).
+see [Compose examples](docker/examples/README.md). The two all-five examples
+use the vendored [OpenBSD TALs and constraints](tals/README.md) with resource
+constraints enabled. Edit the copied policy files or set top-level
+`ta-constraints-enabled = false` to disable them.
 
 Inspect `output/summary.json` and `output/vrps.csv`. Logs go to stderr.
 Reuse the state directory to allow delta updates on subsequent runs.
@@ -61,9 +65,8 @@ For continuous operation see [Usage](docs/usage.md#continuous-operation).
 - CSV, CCR, JSON summaries and configurable text or JSON logs from TOML.
 - Daemon intervals, persistent state, run retention, timeouts and graceful stop.
 
-Version 0.1.0 accepts HTTPS RRDP through its CLI. Operators supply explicit
-TALs; automatic TA refresh follows each TAL's HTTPS or rsync URI. No RTR server
-is included. See the
+The CLI accepts HTTPS RRDP. Operators supply explicit TALs; automatic TA refresh
+follows each TAL's HTTPS or rsync URI. No RTR server is included. See the
 [standards matrix](docs/conformance-matrix.md) for profiles and limitations.
 
 ## Documentation
diff --git a/THIRD_PARTY_NOTICES.md b/THIRD_PARTY_NOTICES.md
index 6226ad7..e7112e9 100644
--- a/THIRD_PARTY_NOTICES.md
+++ b/THIRD_PARTY_NOTICES.md
@@ -12,7 +12,10 @@ binary distributions. Container OS package notices remain under
 
 Python cryptography and OpenSSL are external test tools, not bundled source.
 Consult their installed license notices when distributing a test environment.
-No production trust-anchor or repository data is included in this source tree.
+The `tals/` directory contains unmodified OpenBSD-distributed RIR TALs and
+resource constraints. Their [provenance and checksums](tals/README.md), original
+notices and referenced terms apply separately from the source-code license.
+No RIR repository objects or private keys are bundled.
 
 | Package | Locked version | Declared license |
 | --- | --- | --- |
diff --git a/docker/compose.all5-daemon.yaml b/docker/compose.all5-daemon.yaml
index 5cea1c2..db5e686 100644
--- a/docker/compose.all5-daemon.yaml
+++ b/docker/compose.all5-daemon.yaml
@@ -1,5 +1,7 @@
 # Copy docker/examples/daemon-all5.toml and set CONFIG_FILE to its absolute path.
 # Examples use text logs and automatic TA certificate refresh; TALs stay local.
+# Copy tals/*.tal and tals/*.constraints into INPUT_DIR; constraints default on.
+# Edit the copied constraints, or set ta-constraints-enabled = false in TOML.
 # See docs/docker.md for graceful stop and config reload.
 services:
   validator:
diff --git a/docker/compose.all5.yaml b/docker/compose.all5.yaml
index 51fdca6..3f51cb9 100644
--- a/docker/compose.all5.yaml
+++ b/docker/compose.all5.yaml
@@ -1,5 +1,7 @@
 # Copy docker/examples/validate-all5.toml and set CONFIG_FILE to its absolute path.
 # Examples use text logs and automatic TA certificate refresh; TALs stay local.
+# Copy tals/*.tal and tals/*.constraints into INPUT_DIR; constraints default on.
+# Edit the copied constraints, or set ta-constraints-enabled = false in TOML.
 # See docs/docker.md for graceful stop and config reload.
 services:
   validator:
diff --git a/docker/compose.localhost.yaml b/docker/compose.localhost.yaml
new file mode 100644
index 0000000..8ef26da
--- /dev/null
+++ b/docker/compose.localhost.yaml
@@ -0,0 +1,24 @@
+# Host-side test repository workflow.
+# Start tests/support/serve_repository.py on the host, then run this validator
+# with FIXTURE_DIR pointing at the generated fixture and network_mode=host.
+services:
+  validator:
+    build:
+      context: ..
+      dockerfile: docker/Dockerfile
+    image: "${PANDA_RPKI_IMAGE:-panda-rpki:local}"
+    network_mode: host
+    user: "${PUID:-1000}:${PGID:-1000}"
+    read_only: true
+    init: true
+    tmpfs:
+      - /tmp
+    volumes:
+      - ${CONFIG_FILE:?set CONFIG_FILE to validate-localhost.toml}:/config/validate.toml:ro
+      - ${FIXTURE_DIR:?set FIXTURE_DIR to the generated test fixture}:/fixture:ro
+      - ${OUTPUT_DIR:?set OUTPUT_DIR to a writable output directory}:/output
+      - ${STATE_DIR:?set STATE_DIR to a writable state directory}:/state
+    command:
+      - validate
+      - --config
+      - /config/validate.toml
diff --git a/docker/examples/README.md b/docker/examples/README.md
index eb5caa3..a91cb9e 100644
--- a/docker/examples/README.md
+++ b/docker/examples/README.md
@@ -7,9 +7,10 @@ startup, graceful stop and config reload.
 | File | Mode | Inputs |
 | --- | --- | --- |
 | validate.toml | Single run | /input/anchor.tal |
-| validate-all5.toml | Single run | Five named RIR TALs |
+| validate-all5.toml | Single run | Five named RIR TALs and constraints |
+| validate-localhost.toml | Single run | Generated localhost HTTPS repository and `/fixture/certs/rrdp-ca.pem` |
 | daemon.toml | Continuous | /input/anchor.tal |
-| daemon-all5.toml | Continuous | Five named RIR TALs |
+| daemon-all5.toml | Continuous | Five named RIR TALs and constraints |
 
 All examples use text/info diagnostics, require-complete=true, and automatic
 TA certificate refresh (ta omitted). TAL files are never automatically updated.
@@ -22,3 +23,36 @@ Container paths differ from native configuration paths. Validate uses
 /state/repository and /state/repository.ta-cache under the writable /state mount;
 daemon uses /data/state and /data/state.ta-cache. Existing /state databases need
 an explicit migration or separate cache mount before switching to these paths.
+
+The all5 examples explicitly enable TA constraints. Copy `tals/*.tal` and
+`tals/*.constraints` from the repository into INPUT_DIR. Customize those copies
+or set top-level `ta-constraints-enabled = false` to disable all policies,
+including same-stem file discovery. See [provenance](../../tals/README.md).
+
+## Local HTTPS test repository
+
+`validate-localhost.toml` explicitly sets `http-root-cert` to the CA generated
+by `tests/support/generate_repository.py`. The server runs on the host at
+`localhost:8443`; the Compose example therefore uses host networking. The
+fixture and its CA are generated for the test run and are not production trust
+roots:
+
+```bash
+work="$(mktemp -d)"
+python3 tests/support/generate_repository.py \
+  --rrdp-host localhost --rrdp-port 8443 --output "$work/fixture"
+ln -s cases/baseline-v1/http "$work/fixture/active"
+mkdir -p "$work/output" "$work/state"
+python3 tests/support/serve_repository.py \
+  "$work/fixture/active" 8443 \
+  "$work/fixture/certs/rrdp-server.pem" \
+  "$work/fixture/certs/rrdp-server.key" >"$work/server.log" 2>&1 &
+server_pid="$!"
+trap 'kill "$server_pid" 2>/dev/null || true; rm -rf "$work"' EXIT
+for _ in $(seq 1 50); do grep -qx ready "$work/server.log" && break; sleep 0.1; done
+grep -qx ready "$work/server.log"
+export CONFIG_FILE="$PWD/docker/examples/validate-localhost.toml"
+export FIXTURE_DIR="$work/fixture" OUTPUT_DIR="$work/output" STATE_DIR="$work/state"
+export PUID="$(id -u)" PGID="$(id -g)"
+docker compose -f docker/compose.localhost.yaml run --build --rm validator
+```
diff --git a/docker/examples/daemon-all5.toml b/docker/examples/daemon-all5.toml
index 315ea99..8cc6553 100644
--- a/docker/examples/daemon-all5.toml
+++ b/docker/examples/daemon-all5.toml
@@ -10,30 +10,37 @@ shutdown-grace-secs = 30
 run-timeout-secs = 1800
 require-complete = true
 ta-refresh-policy = "allow-valid-cache"
+# Set false to ignore all constraints files, including adjacent auto-discovery.
+ta-constraints-enabled = true
 log-level = "info"
 log-format = "text"
 
 [[anchors]]
 id = "afrinic"
 tal = "/input/afrinic.tal"
+constraints = "/input/afrinic.constraints"
 # ta = "/input/afrinic.cer" # uncomment to pin a fixed TA certificate
 
 [[anchors]]
 id = "apnic"
 tal = "/input/apnic.tal"
+constraints = "/input/apnic.constraints"
 # ta = "/input/apnic.cer" # uncomment to pin a fixed TA certificate
 
 [[anchors]]
 id = "arin"
 tal = "/input/arin.tal"
+constraints = "/input/arin.constraints"
 # ta = "/input/arin.cer" # uncomment to pin a fixed TA certificate
 
 [[anchors]]
 id = "lacnic"
 tal = "/input/lacnic.tal"
+constraints = "/input/lacnic.constraints"
 # ta = "/input/lacnic.cer" # uncomment to pin a fixed TA certificate
 
 [[anchors]]
 id = "ripe"
 tal = "/input/ripe.tal"
+constraints = "/input/ripe.constraints"
 # ta = "/input/ripe.cer" # uncomment to pin a fixed TA certificate
diff --git a/docker/examples/validate-all5.toml b/docker/examples/validate-all5.toml
index 8f69d5f..c23e85f 100644
--- a/docker/examples/validate-all5.toml
+++ b/docker/examples/validate-all5.toml
@@ -8,30 +8,37 @@ ccr-out = "/output/result.ccr"
 run-timeout-secs = 1800
 require-complete = true
 ta-refresh-policy = "allow-valid-cache"
+# Set false to ignore all constraints files, including adjacent auto-discovery.
+ta-constraints-enabled = true
 log-level = "info"
 log-format = "text"
 
 [[anchors]]
 id = "afrinic"
 tal = "/input/afrinic.tal"
+constraints = "/input/afrinic.constraints"
 # ta = "/input/afrinic.cer" # uncomment to pin a fixed TA certificate
 
 [[anchors]]
 id = "apnic"
 tal = "/input/apnic.tal"
+constraints = "/input/apnic.constraints"
 # ta = "/input/apnic.cer" # uncomment to pin a fixed TA certificate
 
 [[anchors]]
 id = "arin"
 tal = "/input/arin.tal"
+constraints = "/input/arin.constraints"
 # ta = "/input/arin.cer" # uncomment to pin a fixed TA certificate
 
 [[anchors]]
 id = "lacnic"
 tal = "/input/lacnic.tal"
+constraints = "/input/lacnic.constraints"
 # ta = "/input/lacnic.cer" # uncomment to pin a fixed TA certificate
 
 [[anchors]]
 id = "ripe"
 tal = "/input/ripe.tal"
+constraints = "/input/ripe.constraints"
 # ta = "/input/ripe.cer" # uncomment to pin a fixed TA certificate
diff --git a/docker/examples/validate-localhost.toml b/docker/examples/validate-localhost.toml
new file mode 100644
index 0000000..a8a1412
--- /dev/null
+++ b/docker/examples/validate-localhost.toml
@@ -0,0 +1,21 @@
+# Use with docker/compose.localhost.yaml or docker run --network host.
+# The fixture is mounted at /fixture and is created by
+# tests/support/generate_repository.py.
+config-version = 1
+mode = "validate"
+out = "/output"
+rrdp-state-dir = "/state/repository"
+rrdp-sync-mode = "snapshot"
+ccr-out = "/output/result.ccr"
+http-timeout-secs = 5
+# This is the CA for the fixture's HTTPS RRDP server, not an RPKI TA.
+http-root-cert = ["/fixture/certs/rrdp-ca.pem"]
+log-level = "info"
+log-format = "text"
+require-complete = true
+run-timeout-secs = 300
+
+[[anchors]]
+id = "custom"
+tal = "/fixture/tal/custom.tal"
+ta = "/fixture/ta/custom-ta.cer"
diff --git a/docs/configuration.md b/docs/configuration.md
index 83dbf60..476978b 100644
--- a/docs/configuration.md
+++ b/docs/configuration.md
@@ -52,6 +52,7 @@ those choices do not change the built-in defaults.
 | `config-version` | Integer | Explicit `1` required | Configuration schema version, not the software version. Missing or unsupported versions are rejected. |
 | `mode` | String | Required | `validate` or `daemon`; must match the command. |
 | `anchors` | Array of tables | At least one required | Write `[[anchors]]` entries; see section 5. No automatic TAL-directory scan. |
+| `ta-constraints-enabled` | Boolean | true | Apply explicit or adjacent TA constraints files. False skips all constraints loading and enforcement, including adjacent discovery; unused missing or malformed files are ignored. |
 | `ta-refresh-policy` | String | `allow-valid-cache` | On automatic TA download failure, permit a revalidated, usable cached certificate. `require-fresh` prohibits fallback. Does not replace fixed TA files. |
 | `max-ca-depth` | Nonnegative integer | 64 | Maximum CA validation-tree depth. Zero is accepted by configuration parsing, but is a depth limit, not unlimited traversal. Usually keep 64. |
 | `http-timeout-secs` | Nonnegative integer, seconds | 300 | HTTP fetch timeout. Zero is normalized to one second, not unlimited. Does not set the whole-run or rsync timeout. |
@@ -113,7 +114,7 @@ otherwise 3 if strict completion is enabled and any cycle was partial; otherwise
 | `id` | String | TAL filename stem | Identifier in results, logs and constraints. An explicitly empty string also falls back to the filename stem. Resolved IDs must be nonempty and unique; explicit names are preferred. |
 | `tal` | File path | Required | TAL obtained from an independently trusted source; must exist and parse during preflight. Contains certificate URIs and the trusted public key. |
 | `ta` | File path | Omitted: automatic mode | If present, selects a fixed DER TA certificate. Preflight checks binding, certificate profile/signature and validity. Network downloads do not silently replace it. |
-| `constraints` | File path | Discover same-stem `.constraints` | For ripe.tal, try ripe.constraints. Absence of that file means no additional constraints. An explicit path must exist and parse. Omitting this setting does not disable discovery; an empty string is not a disable switch. |
+| `constraints` | File path | Discover same-stem `.constraints` | For ripe.tal, try ripe.constraints. Absence of that file means no additional constraints. When ta-constraints-enabled is true, an explicit path must exist and parse. Omitting this setting does not disable discovery; an empty string is not a disable switch. Set top-level `ta-constraints-enabled = false` to disable all constraints. |
 
 Automatic refresh updates the **TA certificate, never the TAL file**. Each
 validate run or daemon cycle tries the TAL's HTTPS/rsync URIs in order. There is
@@ -292,3 +293,29 @@ produces this excerpt, not the full print output:
 | Logs still JSON | Check top-level settings, recreate the container and inspect new logs. Metadata remains JSON intentionally. |
 | Exited with code 3 | Stopped with partial aggregate results; inspect summaries/lifecycle logs rather than repeatedly stopping. |
 | Latest absent | No complete success yet; partial does not publish even when it exits 0. |
+
+## TA resource constraints
+
+The repository includes five OpenBSD TALs and matching constraints in
+[`tals/`](../tals/README.md), with pinned provenance and checksums. Both all5
+examples explicitly enable them. To customize one anchor, edit its constraints
+file or its `constraints = "/input/custom.constraints"` path. Paths must be
+visible inside the container; relative paths resolve against the TOML directory.
+
+To disable every anchor's constraints, set this **before** `[[anchors]]`:
+
+```toml
+ta-constraints-enabled = false
+```
+
+This takes precedence over explicit paths and same-stem discovery. Re-enable
+with `true`; enabled explicit paths must be readable and syntactically valid.
+Absent adjacent files are allowed for custom TALs without explicit paths.
+Check/print and actual validation use the same selection rules. The summary
+records `taConstraintsEnabled` and `taConstraintsApplied` (anchor IDs and paths).
+A loaded empty file imposes no additional restrictions; enabled alone does not
+imply a file was found.
+
+Each run loads a fresh immutable policy snapshot. Reusing RRDP state does not
+reuse validation results from the previous policy. Stop and recreate the daemon
+to adopt TOML changes; follow the Docker reload procedure after editing files.
diff --git a/docs/docker.md b/docs/docker.md
index 33a5f79..f258d85 100644
--- a/docs/docker.md
+++ b/docs/docker.md
@@ -44,12 +44,46 @@ The template mounts the TOML read-only at `/config/validate.toml` and invokes
 `panda-rpki validate --config /config/validate.toml`. Host variables only select
 mounts, image and container UID/GID; they are not read as validator settings.
 
-## All five RIRs
+## Local HTTPS test repository
 
-Put the five RIR TAL files (TA certificates are optional) under `input/` and list them as named anchors in a
-TOML with `/input/...` paths. Then set `CONFIG_FILE` to that file and run:
+Use [validate-localhost.toml](../docker/examples/validate-localhost.toml) and
+[compose.localhost.yaml](../docker/compose.localhost.yaml) to run the generated
+HTTPS repository used by the regression tests. The TOML explicitly sets
+`http-root-cert = ["/fixture/certs/rrdp-ca.pem"]`; this is the generated test
+server CA, separate from the RPKI trust anchor. The validator uses host
+networking because the generated RRDP URI is `https://localhost:8443`:
 
 ```bash
+work="$(mktemp -d)"
+python3 tests/support/generate_repository.py \
+  --rrdp-host localhost --rrdp-port 8443 --output "$work/fixture"
+ln -s cases/baseline-v1/http "$work/fixture/active"
+mkdir -p "$work/output" "$work/state"
+python3 tests/support/serve_repository.py \
+  "$work/fixture/active" 8443 \
+  "$work/fixture/certs/rrdp-server.pem" \
+  "$work/fixture/certs/rrdp-server.key" >"$work/server.log" 2>&1 &
+server_pid="$!"
+trap 'kill "$server_pid" 2>/dev/null || true; rm -rf "$work"' EXIT
+for _ in $(seq 1 50); do grep -qx ready "$work/server.log" && break; sleep 0.1; done
+grep -qx ready "$work/server.log"
+export CONFIG_FILE="$PWD/docker/examples/validate-localhost.toml"
+export FIXTURE_DIR="$work/fixture" OUTPUT_DIR="$work/output" STATE_DIR="$work/state"
+export PUID="$(id -u)" PGID="$(id -g)"
+docker compose -f docker/compose.localhost.yaml run --build --rm validator
+```
+
+## All five RIRs
+
+Copy the vendored [OpenBSD TALs and constraints](../tals/README.md) into an
+operator-managed input directory. Review the retained upstream notices, including
+the ARIN disclaimer. TA certificates are optional; the examples refresh them.
+Both all5 templates enable constraints by default:
+
+```bash
+mkdir -p input state/all5 output/all5
+cp tals/*.tal tals/*.constraints input/
+cp docker/examples/validate-all5.toml all5.toml
 export CONFIG_FILE="$PWD/all5.toml"
 export INPUT_DIR="$PWD/input" STATE_DIR="$PWD/state/all5" OUTPUT_DIR="$PWD/output/all5"
 docker compose -f docker/compose.all5.yaml run --build --rm validator
@@ -116,6 +150,7 @@ These templates use automatic **TA certificate** refresh, text/info logs and
 | Compose file | Complete TOML |
 | --- | --- |
 | `compose.yaml` | [validate.toml](../docker/examples/validate.toml) |
+| `compose.localhost.yaml` | [validate-localhost.toml](../docker/examples/validate-localhost.toml) |
 | `compose.all5.yaml` | [validate-all5.toml](../docker/examples/validate-all5.toml) |
 | `compose.daemon.yaml` | [daemon.toml](../docker/examples/daemon.toml) |
 | `compose.all5-daemon.yaml` | [daemon-all5.toml](../docker/examples/daemon-all5.toml) |
@@ -123,6 +158,8 @@ These templates use automatic **TA certificate** refresh, text/info logs and
 For example, from the repository root:
 
 ```bash
+mkdir -p input
+cp tals/*.tal tals/*.constraints input/
 cp docker/examples/daemon-all5.toml daemon.toml
 export CONFIG_FILE="$PWD/daemon.toml"
 export INPUT_DIR="$PWD/input" DAEMON_DIR="$PWD/daemon-state"
@@ -187,3 +224,16 @@ The controller logs are in `docker compose logs`; child diagnostics are in
 format. JSON summary/metadata files remain JSON even with text diagnostics.
 `latest` exists only after a complete success; partial runs do not create or
 replace it, including the first run after upgrading an old state root.
+
+## Change or disable constraints
+
+Edit the copied `input/<rir>.constraints` files, or set an anchor's `constraints`
+to a different file under `/input`. Set top-level `ta-constraints-enabled = false`
+to disable all policies, including same-stem auto-discovery. The all5 examples
+use `true` and explicit paths so missing files fail configuration checks.
+
+Use the stop/check/print/force-recreate steps above after editing. Validate-only
+runs read the configuration and policies afresh on each invocation. Do not
+copy vendored files over customized input files during an image upgrade; merge
+upstream updates deliberately and retain backups. No online TAL or policy
+update is performed by the validator.
diff --git a/docs/trust-anchors.md b/docs/trust-anchors.md
index a614253..3d12ac2 100644
--- a/docs/trust-anchors.md
+++ b/docs/trust-anchors.md
@@ -6,7 +6,11 @@ Panda RPKI requires a TAL for each configured anchor. The TAL supplies the
 trusted public key and its certificate URI. You may pin a matching DER-encoded
 TA certificate in TOML, or omit `ta` and let Panda fetch, validate and cache the
 current certificate on each run. A certificate alone is not a substitute for an
-independently obtained TAL. No RIR inputs are bundled with this project.
+independently obtained TAL. The repository includes a pinned OpenBSD snapshot of all five TALs and resource
+constraints in [`tals/`](../tals/README.md); TA certificates are not bundled.
+The all5 Compose examples use these policies by default. Copy the ten files
+to your managed input directory, inspect their provenance, and follow the
+[Docker instructions](docker.md#all-five-rirs).
 
 ## Automatic and fixed certificate modes
 
diff --git a/examples/config/README.md b/examples/config/README.md
index 94c5c9d..56dba05 100644
--- a/examples/config/README.md
+++ b/examples/config/README.md
@@ -10,6 +10,7 @@ also needs a valid, matching ripe.cer. No live inputs are bundled here.
 | [validate-minimal.toml](validate-minimal.toml) | Minimal automatic TA; built-in defaults |
 | [validate-full.toml](validate-full.toml) | Common/validate settings, strict completion, successful publication |
 | [validate-fixed.toml](validate-fixed.toml) | Fixed TA certificate |
+| [validate-localhost.toml](validate-localhost.toml) | Generated localhost HTTPS repository with an explicit HTTP CA |
 | [daemon-all5.toml](daemon-all5.toml) | Five automatic TAs, continuous operation |
 | [daemon-three.toml](daemon-three.toml) | Five automatic TAs, three cycles with independent state |
 
@@ -30,3 +31,29 @@ one exists.
 Full/daemon examples explicitly choose require-complete=true and
 run-timeout-secs=1800; built-in defaults are false and 0. Use the
 [Docker examples](../../docker/examples/README.md) for container paths.
+
+## Local HTTPS test repository
+
+`validate-localhost.toml` is a runnable example for the generated repository
+used by the regression tests. It explicitly sets `http-root-cert` to the test
+CA and uses a fixed RPKI TA so the run does not depend on an external TA
+endpoint. Copy it beside the generated fixture because its paths are relative
+to the configuration file:
+
+```bash
+work="$(mktemp -d)"
+cp examples/config/validate-localhost.toml "$work/validate.toml"
+python3 tests/support/generate_repository.py \
+  --rrdp-host localhost --rrdp-port 8443 --output "$work/fixture"
+ln -s cases/baseline-v1/http "$work/fixture/active"
+mkdir -p "$work/output/localhost" "$work/state/localhost"
+python3 tests/support/serve_repository.py \
+  "$work/fixture/active" 8443 \
+  "$work/fixture/certs/rrdp-server.pem" \
+  "$work/fixture/certs/rrdp-server.key" >"$work/server.log" 2>&1 &
+server_pid="$!"
+trap 'kill "$server_pid" 2>/dev/null || true; rm -rf "$work"' EXIT
+for _ in $(seq 1 50); do grep -qx ready "$work/server.log" && break; sleep 0.1; done
+grep -qx ready "$work/server.log"
+target/release/panda-rpki validate --config "$work/validate.toml"
+```
diff --git a/examples/config/validate-localhost.toml b/examples/config/validate-localhost.toml
new file mode 100644
index 0000000..bf0a102
--- /dev/null
+++ b/examples/config/validate-localhost.toml
@@ -0,0 +1,20 @@
+# Copy this file into a temporary test directory next to the generated fixture.
+# The fixture is created by tests/support/generate_repository.py.
+config-version = 1
+mode = "validate"
+out = "output/localhost"
+rrdp-state-dir = "state/localhost"
+rrdp-sync-mode = "snapshot"
+ccr-out = "output/localhost/result.ccr"
+http-timeout-secs = 5
+# This is the CA for the fixture's HTTPS RRDP server, not an RPKI TA.
+http-root-cert = ["fixture/certs/rrdp-ca.pem"]
+log-level = "info"
+log-format = "text"
+require-complete = true
+run-timeout-secs = 300
+
+[[anchors]]
+id = "custom"
+tal = "fixture/tal/custom.tal"
+ta = "fixture/ta/custom-ta.cer"
diff --git a/src/cli/config.rs b/src/cli/config.rs
index bff0375..95fb9c2 100644
--- a/src/cli/config.rs
+++ b/src/cli/config.rs
@@ -21,6 +21,7 @@ pub struct Config {
     pub mode: String,
     pub anchors: Vec<Anchor>,
     pub ta_refresh_policy: String,
+    pub ta_constraints_enabled: bool,
     pub max_ca_depth: usize,
     pub http_timeout_secs: u64,
     pub http_root_cert: Vec<PathBuf>,
@@ -51,6 +52,7 @@ impl Default for Config {
             mode: String::new(),
             anchors: Vec::new(),
             ta_refresh_policy: "allow-valid-cache".into(),
+            ta_constraints_enabled: true,
             max_ca_depth: 64,
             http_timeout_secs: 300,
             http_root_cert: Vec::new(),
@@ -270,17 +272,13 @@ impl Config {
                     &std::fs::read(ta).map_err(|e| format!("read TA: {e}"))?,
                 )?;
             }
-            let constraints = anchor
-                .constraints
-                .clone()
-                .unwrap_or_else(|| anchor.tal.with_extension("constraints"));
-            if anchor.constraints.is_some() || constraints.exists() {
-                crate::ta_constraints::TaConstraintsByTal::load_for_tals(
-                    &[anchor.input(anchor.ta.as_deref().unwrap_or(&anchor.tal))],
-                    &[format!("{}={}", anchor.id, constraints.display())],
-                )?;
-            }
         }
+        let inputs: Vec<_> = self
+            .anchors
+            .iter()
+            .map(|anchor| anchor.input(anchor.ta.as_deref().unwrap_or(&anchor.tal)))
+            .collect();
+        self.load_constraints(&inputs)?;
         for path in &self.http_root_cert {
             reqwest::Certificate::from_pem(
                 &std::fs::read(path).map_err(|e| format!("read HTTP root: {e}"))?,
@@ -323,6 +321,29 @@ impl Config {
         Ok(())
     }
 
+    /// Use the same policy selection for config inspection and actual validation.
+    /// Explicit disable takes precedence over paths and adjacent-file discovery.
+    pub(crate) fn load_constraints(
+        &self,
+        inputs: &[crate::scheduler::types::TalInputSpec],
+    ) -> Result<crate::ta_constraints::TaConstraintsByTal, String> {
+        if !self.ta_constraints_enabled {
+            return Ok(crate::ta_constraints::TaConstraintsByTal::default());
+        }
+        let overrides: Vec<String> = self
+            .anchors
+            .iter()
+            .filter(|anchor| inputs.iter().any(|input| input.tal_id == anchor.id))
+            .filter_map(|anchor| {
+                anchor
+                    .constraints
+                    .as_ref()
+                    .map(|path| format!("{}={}", anchor.id, path.display()))
+            })
+            .collect();
+        crate::ta_constraints::TaConstraintsByTal::load_for_tals(inputs, &overrides)
+    }
+
     pub(crate) fn child_config(
         &self,
         out: &Path,
@@ -389,3 +410,62 @@ fn collect_sources(
         }
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn constraints_selection_disable_override_and_reload() {
+        let dir = tempfile::tempdir().unwrap();
+        let tal = dir.path().join("test.tal");
+        let adjacent = tal.with_extension("constraints");
+        std::fs::write(&adjacent, "allow 192.0.2.0/24\n").unwrap();
+        let mut config = Config {
+            anchors: vec![Anchor {
+                id: "test".into(),
+                tal,
+                ta: None,
+                constraints: None,
+            }],
+            ..Default::default()
+        };
+        let inputs = vec![config.anchors[0].input(&config.anchors[0].tal)];
+        assert!(
+            config
+                .load_constraints(&inputs)
+                .unwrap()
+                .for_tal("test")
+                .is_some()
+        );
+        // Read fresh policy on each invocation, even with unchanged TAL/state.
+        std::fs::write(&adjacent, "invalid policy").unwrap();
+        assert!(config.load_constraints(&inputs).is_err());
+        let explicit = dir.path().join("custom.constraints");
+        std::fs::write(&explicit, "deny 192.0.2.0/24\n").unwrap();
+        config.anchors[0].constraints = Some(explicit.clone());
+        assert_eq!(
+            config
+                .load_constraints(&inputs)
+                .unwrap()
+                .for_tal("test")
+                .unwrap()
+                .source(),
+            explicit
+        );
+        std::fs::remove_file(explicit).unwrap();
+        assert!(config.load_constraints(&inputs).is_err());
+        config.ta_constraints_enabled = false;
+        assert!(config.load_constraints(&inputs).unwrap().is_empty());
+        config.anchors[0].constraints = None;
+        assert!(config.load_constraints(&inputs).unwrap().is_empty());
+        let child: Config = toml::from_str(
+            &config
+                .child_config(dir.path(), dir.path(), "delta")
+                .unwrap(),
+        )
+        .unwrap();
+        assert!(!child.ta_constraints_enabled);
+        assert!(child.load_constraints(&inputs).unwrap().is_empty());
+    }
+}
diff --git a/src/cli/validate.rs b/src/cli/validate.rs
index e35fc23..dd5a8a2 100644
--- a/src/cli/validate.rs
+++ b/src/cli/validate.rs
@@ -90,18 +90,15 @@ fn execute(config: &Config, run_id: &str) -> Result<i32, String> {
         observer.finish(false);
         return Err("all trust anchors failed".into());
     }
-    let overrides: Vec<String> = config
-        .anchors
+    let constraints = config.load_constraints(&inputs)?;
+    let applied_constraints: Vec<Value> = inputs
         .iter()
-        .filter(|a| inputs.iter().any(|i| i.tal_id == a.id))
-        .filter_map(|a| {
-            a.constraints
-                .as_ref()
-                .map(|p| format!("{}={}", a.id, p.display()))
+        .filter_map(|input| {
+            constraints
+                .for_tal(&input.tal_id)
+                .map(|policy| json!({"id": input.tal_id, "path": policy.source()}))
         })
         .collect();
-    let constraints =
-        crate::ta_constraints::TaConstraintsByTal::load_for_tals(&inputs, &overrides)?;
     // All runtime artifacts are first written under an isolated attempt directory.
     let staging = tempfile::Builder::new()
         .prefix(".validation-")
@@ -148,6 +145,8 @@ fn execute(config: &Config, run_id: &str) -> Result<i32, String> {
     } else {
         "success"
     };
+    summary["taConstraintsEnabled"] = json!(config.ta_constraints_enabled);
+    summary["taConstraintsApplied"] = json!(applied_constraints);
     summary["resultStatus"] = json!(status);
     summary["taFailedCount"] = json!(failed);
     summary["taCacheFallbackCount"] = json!(cached);
diff --git a/tals/README.md b/tals/README.md
new file mode 100644
index 0000000..ca583a0
--- /dev/null
+++ b/tals/README.md
@@ -0,0 +1,42 @@
+# RIR trust anchors and resource constraints
+
+These five TALs and five matching constraints files are unmodified copies from
+[OpenBSD src/etc/rpki](https://github.com/openbsd/src/tree/c10aa57bf0a6504676d00e24f531b5a0f3fa19de/etc/rpki).
+
+- Upstream repository: https://github.com/openbsd/src
+- Pinned commit: `c10aa57bf0a6504676d00e24f531b5a0f3fa19de`
+- Retrieved: 2026-09-18 (UTC)
+- Integrity: `cd tals && sha256sum --check SHA256SUMS`
+
+Upstream comments, attribution and terms are retained in each original file.
+In particular, read the ARIN disclaimer in `arin.tal`
+before using it. These third-party data files are not relicensed under the
+Panda RPKI source-code license. See OpenBSD's [copyright policy](https://www.openbsd.org/policy.html)
+for its distribution policy; the per-file notices and referenced terms remain applicable.
+
+The files contain trust-anchor locators and local resource policy, not TA
+certificates. Automatic TA certificate refresh does not update these files.
+Constraints limit resources accepted for signed objects beneath the matching
+anchor; review upstream changes before adopting them.
+
+## Use and customization
+
+Copy the ten files into a directory you manage and set Compose `INPUT_DIR` to
+that directory. Both all5 TOML examples explicitly enable constraints and use
+`/input/<rir>.constraints`. Edit those files or set an anchor's `constraints`
+path to another file under the input mount. To disable the policy globally,
+set top-level `ta-constraints-enabled = false` before `[[anchors]]`.
+See [configuration](../docs/configuration.md) and [Docker instructions](../docs/docker.md)
+for validation and stop/check/recreate steps. Files are re-read for each
+validation run; a running validation uses its loaded policy snapshot.
+
+## Updating the vendored snapshot
+
+1. Select and record a full OpenBSD commit SHA; fetch all ten files from that
+   same commit's `etc/rpki/` directory (never mix floating master revisions).
+2. Preserve bytes, filenames and notices; review TAL keys/URIs and every policy
+   change, including per-file notices. Update this provenance and `SHA256SUMS`.
+3. Run `cargo test --locked` and configuration checks for both all5 templates,
+   then validate output differences before deploying.
+4. Update operator-managed copies explicitly. Image upgrades must not overwrite
+   a user's edited constraints; keep backups to roll back policy changes.
diff --git a/tals/SHA256SUMS b/tals/SHA256SUMS
new file mode 100644
index 0000000..4ca0ddd
--- /dev/null
+++ b/tals/SHA256SUMS
@@ -0,0 +1,10 @@
+2838ef30ea27ce5705abf5f5adb131d8c35b1f50858338a2f3c84bb207c2fa35  afrinic.tal
+9c9dfc8fa60e1876d505e129e325d3d23b545cc31f13782753e1b8ffb44b7ab2  afrinic.constraints
+472e551f7c551c2e999e582b7c9437d3bee4900fe53afff62aeb28d4940ade94  apnic.tal
+38143f26afb91dee28c87d759a31d9d91daba459238fc434f30f10d7f4d2cf3b  apnic.constraints
+446d1456518637541d6c22e8c1163e5a5751268e1fb2d075338ec8d49b3d8ed8  arin.tal
+13b2005035e4efa3f12b485b3618b2c54661135c58610dd237f71ac3c7896f37  arin.constraints
+45e6364b845b21d006bbe6dbea0f418a809117ff2feebfc23f731fb5e0cf718e  lacnic.tal
+a8742507fc068fc7f74b0c8dc4153c2faedc29534bf52d356f0fd5d8a8abcd75  lacnic.constraints
+59ca27ef93f23682749fcefe7c6d70fbc723343549ff9e4d3996acaff79817fb  ripe.tal
+c14154c3d0f43de96dc34c716f6fe86d4009ec67ed6bc1f54b5a7448ea1edbf3  ripe.constraints
diff --git a/tals/afrinic.constraints b/tals/afrinic.constraints
new file mode 100644
index 0000000..bd1447c
--- /dev/null
+++ b/tals/afrinic.constraints
@@ -0,0 +1,630 @@
+#	$OpenBSD: afrinic.constraints,v 1.4 2026/03/11 21:46:36 job Exp $
+
+# From https://www.iana.org/assignments/ipv4-address-space/
+allow 41.0.0.0/8
+allow 102.0.0.0/8
+allow 105.0.0.0/8
+
+allow 154.0.0.0/16
+allow 154.16.0.0/16
+allow 154.65.0.0 - 154.255.255.255
+allow 196.0.0.0 - 196.1.0.255
+allow 196.1.4.0/24
+allow 196.1.7.0 - 196.1.63.255
+allow 196.1.71.0/24
+allow 196.1.74.0 - 196.1.103.255
+allow 196.1.115.0 - 196.1.133.255
+allow 196.1.137.0/24
+allow 196.1.143.0 - 196.1.159.255
+allow 196.1.176.0 - 196.1.255.255
+allow 196.2.2.0/23
+allow 196.2.8.0 - 196.2.255.255
+allow 196.3.14.0/23
+allow 196.3.57.0 - 196.3.64.255
+allow 196.3.90.0/24
+allow 196.3.92.0 - 196.3.94.255
+allow 196.3.96.0/21
+allow 196.3.105.0/24
+allow 196.3.107.0 - 196.3.131.255
+allow 196.3.148.0/22
+allow 196.3.154.0 - 196.3.183.255
+allow 196.3.224.0 - 196.4.45.255
+allow 196.4.71.0 - 196.11.171.255
+allow 196.11.174.0 - 196.11.239.255
+allow 196.11.248.0/21
+allow 196.12.10.0 - 196.12.31.255
+allow 196.12.128.0/19
+allow 196.12.192.0 - 196.15.15.255
+allow 196.15.64.0 - 196.26.255.255
+allow 196.27.64.0 - 196.28.47.255
+allow 196.28.64.0 - 196.29.63.255
+allow 196.29.96.0 - 196.31.255.255
+allow 196.32.8.0 - 196.32.31.255
+allow 196.32.96.0/19
+allow 196.32.160.0 - 196.39.255.255
+allow 196.40.96.0 - 196.41.255.255
+allow 196.42.64.0 - 196.216.0.255
+allow 196.216.2.0 - 197.255.255.255
+
+# From https://www.iana.org/assignments/ipv6-address-space/
+allow 2001:4200::/23
+allow 2c00::/12
+
+# From https://www.iana.org/assignments/as-numbers/
+allow 36864 - 37887
+allow 327680 - 330751
+
+# From https://www.iana.org/assignments/ipv4-recovered-address-space
+allow 45.96.0.0 - 45.111.255.255
+allow 45.192.0.0 - 45.222.255.255
+allow 45.240.0.0 - 45.247.255.255
+allow 66.251.128.0 - 66.251.191.255
+allow 139.26.0.0 - 139.26.255.255
+allow 146.196.128.0 - 146.196.255.255
+# 154.16.0.0 - 154.16.255.255 # already contained within 154/8
+allow 160.19.36.0 - 160.19.39.255
+allow 160.19.60.0 - 160.19.63.255
+allow 160.19.96.0 - 160.19.103.255
+allow 160.19.112.0  -  160.19.143.255
+allow 160.19.152.0 - 160.19.155.255
+allow 160.19.188.0 - 160.19.191.255
+allow 160.19.192.0 - 160.19.199.255
+allow 160.19.232.0 - 160.19.239.255
+allow 160.20.24.0 - 160.20.31.255
+allow 160.20.112.0 - 160.20.115.255
+allow 160.20.213.0 - 160.20.213.255
+allow 160.20.217.0 - 160.20.217.255
+allow 160.20.221.0 - 160.20.221.255
+allow 160.20.226.0 - 160.20.227.255
+allow 160.20.252.0 - 160.20.255.255
+allow 160.238.11.0 - 160.238.11.255
+allow 160.238.48.0 - 160.238.49.255
+allow 160.238.50.0 - 160.238.50.255
+allow 160.238.57.0 - 160.238.57.255
+allow 160.238.101.0 - 160.238.101.255
+allow 161.123.0.0 - 161.123.255.255
+allow 164.160.0.0 - 164.160.255.255
+allow 192.12.110.0 - 192.12.111.255
+allow 192.12.116.0 - 192.12.117.255
+allow 192.47.36.0 - 192.47.36.255
+allow 192.51.240.0 - 192.51.240.255
+allow 192.70.200.0 - 192.70.201.255
+allow 192.75.236.0 - 192.75.236.255
+allow 192.83.208.0 - 192.83.215.255
+allow 192.91.200.0 - 192.91.200.255
+allow 192.142.0.0 - 192.143.255.255
+allow 192.145.128.0 - 192.145.191.255
+allow 192.145.230.0 - 192.145.230.255
+allow 204.8.204.0 - 204.8.207.255
+allow 208.85.156.0 - 208.85.159.255
+
+# From https://web.archive.org/web/20131120040037/http://www.ripe.net/lir-services/resource-management/erx/transferred-resources
+# From https://afrinic.net/fr/library/policies/220-erx-transfer
+allow 2561
+allow 3208
+allow 5536
+allow 6127
+allow 6713
+allow 6879
+allow 8524
+allow 8770
+allow 9129
+allow 11380
+allow 12455
+allow 12556
+allow 13224
+allow 15399
+allow 13569
+allow 15475
+allow 15706
+allow 15804
+allow 15825
+allow 15834
+allow 15964
+allow 16058
+allow 16214
+allow 16284
+allow 16853
+allow 16907
+allow 17652
+allow 19676
+allow 20294
+allow 20484
+allow 20858
+allow 20928
+allow 21003
+allow 21152
+allow 21242
+allow 21271
+allow 21278
+allow 21280
+allow 21391
+allow 21452
+allow 23549
+allow 23889
+allow 24736
+allow 24757
+allow 24788
+allow 24801
+allow 24835
+allow 24863
+allow 24878
+allow 24987
+allow 25163
+allow 25250
+allow 25362
+allow 25364
+allow 25543
+allow 25568
+allow 25576
+allow 28683
+allow 28698
+allow 28913
+allow 29091
+allow 29338
+allow 29340
+allow 29428
+allow 29495
+allow 29544
+allow 29571
+allow 29614
+allow 29674
+allow 30896
+allow 31065
+allow 31245
+allow 31619
+allow 83.143.24.0 - 83.143.31.255
+allow 84.205.96.0 - 84.205.127.255
+allow 131.176.0.0 - 131.176.255.255
+allow 163.121.0.0 - 163.121.255.255
+allow 165.231.0.0 - 165.231.255.255
+allow 192.52.232.0 - 192.52.232.255
+allow 193.17.215.0 - 193.17.215.255
+allow 193.19.232.0 - 193.19.235.255
+allow 193.41.146.0 - 193.41.147.255
+allow 193.108.23.0 - 193.108.23.255
+allow 193.108.28.0 - 193.108.28.255
+allow 193.109.66.0 - 193.109.67.255
+allow 193.110.104.0 - 193.110.105.255
+allow 193.194.128.0 - 193.194.128.255
+allow 193.227.128.0 - 193.227.128.255
+allow 194.9.64.0 - 194.9.65.255
+allow 194.9.82.0 - 194.9.83.255
+allow 195.24.80.0 - 195.24.87.255
+allow 195.39.218.0 - 195.39.219.255
+allow 195.234.120.0 - 195.234.123.255
+allow 195.234.168.0 - 195.234.168.255
+allow 195.234.185.0 - 195.234.185.255
+allow 195.234.252.0 - 195.234.255.255
+
+# From https://www.ripe.net/participate/internet-governance/internet-technical-community/the-rir-system/afrinic/ripe-ncc-to-afrinic-transition
+allow 30980
+allow 30982 - 30999
+
+# From https://afrinic.net/ast/pdf/afrinic-whois-audit-report-full-20210121.pdf
+# 12.3 Appendix A3
+allow 193.188.7.0/24
+allow 193.189.0.0/18
+allow 193.189.128.0/24
+allow 193.194.160.0/19
+allow 193.221.218.0/24
+
+# From https://ftp.arin.net/afrinic/afrinic-transfers-by-resource.txt
+# Feb 21, 2005
+allow 1228 - 1232
+allow 2018
+allow 2905
+allow 3067
+allow 3068
+allow 3741
+allow 4178
+allow 4571
+allow 5713
+allow 5734
+allow 6083
+allow 6089
+allow 6149
+allow 6180
+allow 6187
+allow 6351
+allow 6529
+allow 6560
+allow 6968
+allow 7020
+allow 7154
+allow 7231
+allow 7390
+allow 7420
+allow 7460
+allow 7971
+allow 7972
+allow 8094
+allow 10247
+allow 10262
+allow 10331
+allow 10393
+allow 10474
+allow 10505
+allow 10540
+allow 10575
+allow 10798
+allow 10803
+allow 10898
+allow 10922
+allow 11125
+allow 11157
+allow 11201
+allow 11259
+allow 11265
+allow 11569
+allow 11645
+allow 11744
+allow 11845
+allow 11909
+allow 12091
+allow 12143
+allow 12258
+allow 13402
+allow 13519
+allow 13854
+allow 14029
+allow 14115
+allow 14331
+allow 14360
+allow 14429
+allow 14516
+allow 14988
+allow 15022
+allow 15159
+allow 16416
+allow 16547
+allow 16630
+allow 16637
+allow 16800
+allow 17148
+allow 17220
+allow 17260
+allow 17312
+allow 17400
+allow 18775
+allow 18922
+allow 18931
+allow 19136
+allow 19232
+allow 19711
+allow 19832
+allow 19847
+allow 20011
+allow 20086
+allow 20095
+allow 20180
+allow 20459
+allow 21739
+allow 21819
+allow 22354
+allow 22355
+allow 22386
+allow 22572
+allow 22690
+allow 22735
+allow 22750
+allow 22939
+allow 23058
+allow 25695
+allow 25726
+allow 25793
+allow 25818
+allow 26106
+allow 26130
+allow 26422
+allow 26625
+allow 26754
+allow 27576
+allow 27598
+allow 29918
+allow 29975
+allow 30073
+allow 30306
+allow 30429
+allow 30619
+allow 31810
+allow 31856
+allow 31960
+allow 32017
+allow 32279
+allow 32398
+allow 32437
+allow 32653
+allow 32714
+allow 32717
+allow 32842
+allow 32860
+allow 33567
+allow 33579
+allow 33762 - 33791
+allow 64.57.112.0 - 64.57.127.255
+allow 66.8.0.0 - 66.8.127.255
+allow 66.18.64.0 - 66.18.95.255
+allow 69.63.64.0 - 69.63.79.255
+allow 69.67.32.0 - 69.67.47.255
+allow 137.158.0.0 - 137.158.255.255
+allow 137.214.0.0 - 137.214.255.255
+allow 137.215.0.0 - 137.215.255.255
+allow 139.53.0.0 - 139.53.255.255
+allow 143.128.0.0 - 143.128.255.255
+allow 143.160.0.0 - 143.160.255.255
+allow 146.64.0.0 - 146.64.255.255
+allow 146.141.0.0 - 146.141.255.255
+allow 146.182.0.0 - 146.182.255.255
+allow 146.230.0.0 - 146.230.255.255
+allow 146.231.0.0 - 146.231.255.255
+allow 146.232.0.0 - 146.232.255.255
+allow 147.110.0.0 - 147.110.255.255
+allow 152.106.0.0 - 152.106.255.255
+allow 152.107.0.0 - 152.107.255.255
+allow 152.108.0.0 - 152.108.255.255
+allow 152.109.0.0 - 152.109.255.255
+allow 152.110.0.0 - 152.110.255.255
+allow 152.111.0.0 - 152.111.255.255
+allow 152.112.0.0 - 152.112.255.255
+allow 155.159.0.0 - 155.159.255.255
+allow 155.232.0.0 - 155.232.255.255
+allow 155.233.0.0 - 155.233.255.255
+allow 155.234.0.0 - 155.234.255.255
+allow 155.235.0.0 - 155.235.255.255
+allow 155.236.0.0 - 155.236.255.255
+allow 155.237.0.0 - 155.237.255.255
+allow 155.238.0.0 - 155.238.255.255
+allow 155.239.0.0 - 155.239.255.255
+allow 155.240.0.0 - 155.240.255.255
+allow 156.8.0.0 - 156.8.255.255
+allow 160.115.0.0 - 160.115.255.255
+allow 160.116.0.0 - 160.116.255.255
+allow 160.117.0.0 - 160.117.255.255
+allow 160.118.0.0 - 160.118.255.255
+allow 160.119.0.0 - 160.119.255.255
+allow 160.120.0.0 - 160.120.255.255
+allow 160.121.0.0 - 160.121.255.255
+allow 160.122.0.0 - 160.122.255.255
+allow 160.123.0.0 - 160.123.255.255
+allow 160.124.0.0 - 160.124.255.255
+allow 163.195.0.0 - 163.195.255.255
+allow 163.196.0.0 - 163.196.255.255
+allow 163.197.0.0 - 163.197.255.255
+allow 163.198.0.0 - 163.198.255.255
+allow 163.199.0.0 - 163.199.255.255
+allow 163.200.0.0 - 163.200.255.255
+allow 163.201.0.0 - 163.201.255.255
+allow 163.202.0.0 - 163.202.255.255
+allow 163.203.0.0 - 163.203.255.255
+allow 164.88.0.0 - 164.88.255.255
+allow 164.146.0.0 - 164.151.255.255
+allow 164.155.0.0 - 164.155.255.255
+allow 165.3.0.0 - 165.5.255.255
+allow 165.8.0.0 - 165.11.255.255
+allow 165.25.0.0 - 165.25.255.255
+allow 165.143.0.0 - 165.149.255.255
+allow 165.165.0.0 - 165.165.255.255
+allow 165.180.0.0 - 165.180.255.255
+allow 165.233.0.0 - 165.233.255.255
+allow 166.85.0.0 - 166.85.255.255
+allow 168.76.0.0 - 168.76.255.255
+allow 168.80.0.0 - 168.81.255.255
+allow 168.89.0.0 - 168.89.255.255
+allow 168.128.0.0 - 168.128.255.255
+allow 168.142.0.0 - 168.142.255.255
+allow 168.155.0.0 - 168.155.255.255
+allow 168.164.0.0 - 168.164.255.255
+allow 168.167.0.0 - 168.167.255.255
+allow 168.172.0.0 - 168.172.255.255
+allow 168.206.0.0 - 168.206.255.255
+allow 168.209.0.0 - 168.210.255.255
+allow 169.129.0.0 - 169.129.255.255
+allow 169.202.0.0 - 169.202.255.255
+allow 192.33.10.0 - 192.33.10.255
+allow 192.42.99.0 - 192.42.99.255
+allow 192.48.253.0 - 192.48.253.255
+allow 192.68.138.0 - 192.68.138.255
+allow 192.70.237.0 - 192.70.237.255
+allow 192.82.142.0 - 192.82.142.255
+allow 192.84.244.0 - 192.84.244.255
+allow 192.94.61.0 - 192.94.61.255
+allow 192.94.210.0 - 192.94.210.255
+allow 192.94.240.0 - 192.94.240.255
+allow 192.94.241.0 - 192.94.241.255
+allow 192.94.246.0 - 192.94.246.255
+allow 192.96.0.0 - 192.96.255.255
+allow 192.100.1.0 - 192.100.1.255
+allow 192.101.142.0 - 192.101.142.255
+allow 192.102.9.0 - 192.102.9.255
+allow 192.133.250.0 - 192.133.250.255
+allow 192.136.55.0 - 192.136.55.255
+allow 192.136.56.0 - 192.136.56.255
+allow 192.136.57.0 - 192.136.57.255
+allow 192.157.190.0 - 192.157.190.255
+allow 192.188.164.0 - 192.188.167.255
+allow 192.189.75.0 - 192.189.75.255
+allow 192.189.139.0 - 192.189.140.255
+allow 192.231.237.0 - 192.231.237.255
+allow 192.231.254.0 - 192.231.254.255
+allow 192.245.148.0 - 192.245.148.255
+allow 192.251.202.0 - 192.251.202.255
+allow 198.54.0.0 - 198.54.255.255
+allow 200.16.8.0 - 200.16.15.255
+allow 204.12.128.0 - 204.12.143.255
+allow 204.87.179.0 - 204.87.179.255
+allow 204.152.14.0 - 204.152.15.255
+allow 204.235.32.0 - 204.235.43.255
+allow 205.159.79.0 - 205.159.79.255
+allow 206.223.136.0 - 206.223.136.255
+allow 209.203.0.0 - 209.203.63.255
+allow 209.212.96.0 - 209.212.127.255
+allow 216.236.176.0 - 216.236.191.255
+
+# From rpki.afrinic.net/repository/04E8B0D80F4D11E0B657D8931367AE7D/apnic-to-afrinic.cer
+# CN=APNICTOAFRINIC/serialNumber=6F1A103E1427FF03483ABFD9E34DACBE1524FF8B
+# Not Before: Mar 30 14:17:08 2020 GMT / Not After : Mar 30 00:00:00 2025 GMT
+# SHA256:B6w5P1mkoNyJtM99GfGLaaKkGfSkQ6+4eC4tPijBLyM=
+allow 202.123.0.0/19
+
+# From rpki.afrinic.net/repository/04E8B0D80F4D11E0B657D8931367AE7D/ripe-to-afrinic.cer
+# CN=RIPETOAFRINIC/serialNumber=7F7AC180897983E29E937C0A187803C072755545
+# Not Before: Mar 30 14:17:12 2020 GMT / Not After : Mar 30 00:00:00 2025 GMT
+# SHA256:64eh2w7qQrFQVPaQrRJ4kA83gUgE3EDvm0D0AWHCXHM=
+allow 62.8.64.0/19
+allow 62.12.96.0/19
+allow 62.24.96.0/19
+allow 62.61.192.0/18
+allow 62.68.32.0/19
+allow 62.68.224.0/19
+allow 62.114.0.0/16
+allow 62.117.32.0/19
+allow 62.135.0.0/17
+allow 62.139.0.0/16
+allow 62.140.64.0/18
+allow 62.173.32.0/19
+allow 62.193.64.0/18
+allow 62.193.160.0/19
+allow 62.240.32.0/19
+allow 62.240.96.0/19
+allow 62.241.128.0/19
+allow 62.251.128.0/17
+allow 77.220.0.0/19
+allow 80.67.128.0/20
+allow 80.72.96.0/20
+allow 80.75.160.0/19
+allow 80.87.64.0/19
+allow 80.88.0.0/20
+allow 80.95.0.0/20
+allow 80.240.192.0/20
+allow 80.246.0.0/20
+allow 80.248.0.0/20
+allow 80.248.64.0/20
+allow 80.249.64.0/20
+allow 80.250.32.0/20
+allow 81.4.0.0/18
+allow 81.10.0.0/17
+allow 81.21.96.0/20
+allow 81.22.64.0/19
+allow 81.26.64.0/20
+allow 81.29.96.0/20
+allow 81.91.224.0/20
+allow 81.192.0.0/16
+allow 82.101.128.0/18
+allow 82.128.0.0/17
+allow 82.129.128.0/17
+allow 82.151.64.0/19
+allow 82.201.128.0/17
+allow 84.36.0.0/16
+allow 84.233.0.0/17
+allow 87.255.96.0/19
+allow 193.95.0.0/17
+allow 193.108.214.0/24
+allow 193.108.252.0/22
+allow 193.189.64.0 - 193.189.65.255
+allow 193.194.1.0 - 193.194.5.255
+allow 193.194.32.0 - 193.194.95.255
+allow 193.227.0.0/18
+allow 194.6.224.0/24
+allow 194.79.96.0/19
+allow 194.204.192.0/18
+allow 195.24.192.0/19
+allow 195.43.0.0/19
+allow 195.166.224.0/19
+allow 195.202.64.0/19
+allow 195.246.32.0/19
+allow 212.0.128.0/19
+allow 212.12.224.0/19
+allow 212.22.160.0/19
+allow 212.49.64.0/19
+allow 212.52.128.0/19
+allow 212.60.64.0/19
+allow 212.85.192.0/19
+allow 212.88.96.0/19
+allow 212.96.0.0/19
+allow 212.100.64.0/19
+allow 212.103.160.0/19
+allow 212.122.224.0/19
+allow 212.217.0.0/17
+allow 213.55.64.0/18
+allow 213.131.64.0/19
+allow 213.136.96.0/19
+allow 213.147.64.0/19
+allow 213.150.96.0/19
+allow 213.150.160.0 - 213.150.223.255
+allow 213.152.64.0/19
+allow 213.154.32.0 - 213.154.95.255
+allow 213.158.160.0/19
+allow 213.172.128.0/19
+allow 213.179.160.0/19
+allow 213.181.224.0/19
+allow 213.193.32.0/19
+allow 213.212.192.0/18
+allow 213.247.0.0/19
+allow 213.255.128.0/19
+allow 217.14.80.0/20
+allow 217.20.224.0/20
+allow 217.21.112.0/20
+allow 217.29.128.0/20
+allow 217.29.208.0/20
+allow 217.52.0.0/14
+allow 217.64.96.0/20
+allow 217.77.64.0/20
+allow 217.78.64.0/20
+allow 217.117.0.0/20
+allow 217.139.0.0/16
+allow 217.170.144.0/20
+allow 217.199.144.0/20
+
+# From rpki.afrinic.net/repository/04E8B0D80F4D11E0B657D8931367AE7D/arin-to-afrinic.cer
+# CN=ARINTOAFRINIC/serialNumber=B87C5A75F3D957413AB998646946D4541D511455
+# Not Before: Mar 30 14:17:09 2020 GMT / Not After : Mar 30 00:00:00 2025 GMT
+# SHA256:wmJV3qcwiPcLtEMLBcvvyjs4V1Lz690bK3b8cv5v8F8=
+allow 129.0.0.0/16
+allow 129.18.0.0/16
+allow 129.45.0.0/16
+allow 129.56.0.0/16
+allow 129.122.0.0/16
+allow 129.140.0.0/16
+allow 129.205.0.0/16
+allow 129.232.0.0/16
+allow 137.63.0.0 - 137.64.255.255
+allow 137.115.0.0/16
+allow 137.171.0.0/16
+allow 137.196.0.0/16
+allow 137.255.0.0/16
+allow 155.0.0.0/16
+allow 155.11.0.0 - 155.12.255.255
+allow 155.89.0.0/16
+allow 155.93.0.0/16
+allow 155.196.0.0/16
+allow 155.251.0.0/16
+allow 155.255.0.0 - 156.0.255.255
+allow 156.38.0.0/16
+allow 156.155.0.0 - 156.255.255.255
+allow 160.0.0.0/16
+allow 160.77.0.0/16
+allow 160.89.0.0 - 160.90.255.255
+allow 160.105.0.0/16
+allow 160.113.0.0/16
+allow 160.152.0.0/16
+allow 160.154.0.0 - 160.179.255.255
+allow 160.181.0.0 - 160.184.255.255
+allow 160.224.0.0 - 160.226.255.255
+allow 160.242.0.0/16
+allow 160.255.0.0/16
+allow 165.0.0.0/16
+allow 165.16.0.0/16
+allow 165.49.0.0 - 165.63.255.255
+allow 165.73.0.0/16
+allow 165.90.0.0/16
+allow 165.169.0.0/16
+allow 165.210.0.0/15
+allow 165.255.0.0/16
+allow 168.211.0.0 - 168.211.255.255
+allow 168.253.0.0/16
+allow 169.0.0.0/15
+allow 169.159.0.0/16
+allow 169.239.0.0/16
+allow 169.255.0.0/16
+allow 192.109.242.0/24
diff --git a/tals/afrinic.tal b/tals/afrinic.tal
new file mode 100644
index 0000000..5ff40bf
--- /dev/null
+++ b/tals/afrinic.tal
@@ -0,0 +1,10 @@
+rsync://rpki.afrinic.net/repository/AfriNIC.cer
+https://rpki.afrinic.net/repository/AfriNIC.cer
+
+MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxsAqAhWIO+ON2Ef9oRDM
+pKxv+AfmSLIdLWJtjrvUyDxJPBjgR+kVrOHUeTaujygFUp49tuN5H2C1rUuQavTH
+vve6xNF5fU3OkTcqEzMOZy+ctkbde2SRMVdvbO22+TH9gNhKDc9l7Vu01qU4LeJH
+k3X0f5uu5346YrGAOSv6AaYBXVgXxa0s9ZvgqFpim50pReQe/WI3QwFKNgpPzfQL
+6Y7fDPYdYaVOXPXSKtx7P4s4KLA/ZWmRL/bobw/i2fFviAGhDrjqqqum+/9w1hEl
+L/vqihVnV18saKTnLvkItA/Bf5i11Yhw2K7qv573YWxyuqCknO/iYLTR1DToBZcZ
+UQIDAQAB
diff --git a/tals/apnic.constraints b/tals/apnic.constraints
new file mode 100644
index 0000000..d6b12cb
--- /dev/null
+++ b/tals/apnic.constraints
@@ -0,0 +1,983 @@
+#	$OpenBSD: apnic.constraints,v 1.8 2026/07/09 12:29:52 job Exp $
+
+# From https://www.iana.org/assignments/ipv6-unicast-address-assignments
+allow 2001:200::/23
+allow 2001:c00::/23
+allow 2001:e00::/23
+allow 2001:4400::/23
+allow 2001:8000::/19
+allow 2001:a000::/20
+allow 2001:b000::/20
+allow 2400::/12
+allow 2410::/12
+
+# IX Assignments
+allow 2001:7fa::/32
+
+# LACNIC ASNs cannot be transferred to APNIC
+# From https://www.iana.org/assignments/as-numbers/as-numbers.xhtml
+deny 27648 - 28671
+deny 52224 - 53247
+deny 61440 - 61951
+deny 64099 - 64197
+deny 262144 - 275868
+
+# LACNIC ASNs cannot be transferred to APNIC
+# From nro-delegated-stats 20240417
+deny 278
+deny 676
+deny 1251
+deny 1292
+deny 1296
+deny 1797
+deny 1831
+deny 1840
+deny 1916
+deny 2146
+deny 2277
+deny 2549
+deny 2638
+deny 2708
+deny 2715 - 2716
+deny 2739
+deny 2904
+deny 3132
+deny 3141
+deny 3449
+deny 3454
+deny 3484
+deny 3487
+deny 3496
+deny 3548
+deny 3551
+deny 3556
+deny 3596 - 3597
+deny 3603
+deny 3631 - 3632
+deny 3636
+deny 3640
+deny 3790
+deny 3816
+deny 3905
+deny 3968
+deny 4141
+deny 4209
+deny 4230
+deny 4242
+deny 4244
+deny 4270
+deny 4387
+deny 4493
+deny 4535
+deny 4914
+deny 4926
+deny 4944
+deny 4964
+deny 4967
+deny 4995
+deny 5005
+deny 5633
+deny 5639
+deny 5648
+deny 5692
+deny 5708
+deny 5722
+deny 5745
+deny 5772
+deny 6057
+deny 6063 - 6065
+deny 6084
+deny 6121
+deny 6125
+deny 6133
+deny 6135
+deny 6147 - 6148
+deny 6193
+deny 6240
+deny 6306
+deny 6332
+deny 6342
+deny 6400
+deny 6429
+deny 6458
+deny 6471
+deny 6487
+deny 6495
+deny 6503
+deny 6505
+deny 6535
+deny 6543
+deny 6545
+deny 6568
+deny 6590
+deny 6927
+deny 6945
+deny 6957
+deny 7002
+deny 7004 - 7005
+deny 7038
+deny 7048 - 7049
+deny 7056
+deny 7063
+deny 7080
+deny 7087
+deny 7103
+deny 7120
+deny 7125
+deny 7137
+deny 7149
+deny 7157
+deny 7162
+deny 7167
+deny 7173
+deny 7184
+deny 7195
+deny 7199
+deny 7236
+deny 7298
+deny 7303
+deny 7313
+deny 7315
+deny 7325
+deny 7340
+deny 7365
+deny 7399
+deny 7408
+deny 7414
+deny 7417 - 7418
+deny 7428
+deny 7437 - 7438
+deny 7465
+deny 7727
+deny 7738
+deny 7803
+deny 7864
+deny 7890
+deny 7906
+deny 7908
+deny 7910
+deny 7927
+deny 7934
+deny 7953
+deny 7965
+deny 7974
+deny 7980
+deny 7984
+deny 7993 - 7995
+deny 7997
+deny 8007
+deny 8024
+deny 8026
+deny 8048
+deny 8053 - 8056
+deny 8065 - 8066
+deny 8096
+deny 8140 - 8141
+deny 8151
+deny 8163
+deny 8167
+deny 8178
+deny 10269
+deny 10277
+deny 10285
+deny 10293
+deny 10299
+deny 10301
+deny 10318
+deny 10362
+deny 10391
+deny 10412
+deny 10417
+deny 10420
+deny 10429
+deny 10436
+deny 10452
+deny 10454
+deny 10463
+deny 10476
+deny 10479
+deny 10481
+deny 10495
+deny 10502
+deny 10531
+deny 10560
+deny 10569
+deny 10586
+deny 10600
+deny 10605 - 10606
+deny 10617
+deny 10620
+deny 10624
+deny 10630
+deny 10640
+deny 10649
+deny 10670 - 10671
+deny 10688
+deny 10691
+deny 10697
+deny 10704
+deny 10706
+deny 10715
+deny 10733
+deny 10757
+deny 10778
+deny 10785
+deny 10795
+deny 10824
+deny 10834
+deny 10841
+deny 10847
+deny 10875
+deny 10881
+deny 10895
+deny 10897
+deny 10906
+deny 10938
+deny 10954
+deny 10964
+deny 10983
+deny 10986
+deny 10992
+deny 11008
+deny 11014
+deny 11053
+deny 11058
+deny 11063
+deny 11081
+deny 11083
+deny 11087
+deny 11097
+deny 11136
+deny 11172
+deny 11193
+deny 11237
+deny 11242
+deny 11254
+deny 11256
+deny 11271
+deny 11284
+deny 11295
+deny 11311
+deny 11315
+deny 11335
+deny 11338
+deny 11340
+deny 11356
+deny 11373
+deny 11390
+deny 11392
+deny 11411
+deny 11415
+deny 11419
+deny 11431 - 11432
+deny 11447
+deny 11450 - 11451
+deny 11497 - 11498
+deny 11503
+deny 11514
+deny 11519
+deny 11556
+deny 11562
+deny 11571
+deny 11581
+deny 11585
+deny 11592
+deny 11599
+deny 11617
+deny 11642
+deny 11644
+deny 11664
+deny 11673
+deny 11677
+deny 11694
+deny 11706
+deny 11750 - 11752
+deny 11786
+deny 11800 - 11802
+deny 11815 - 11816
+deny 11830
+deny 11835
+deny 11844
+deny 11888
+deny 11896
+deny 11921
+deny 11947
+deny 11960
+deny 11993
+deny 12034
+deny 12066
+deny 12127
+deny 12135 - 12136
+deny 12140
+deny 12146
+deny 12150
+deny 12248
+deny 12252
+deny 12264
+deny 13316
+deny 13318
+deny 13320
+deny 13353
+deny 13357
+deny 13381
+deny 13424
+deny 13440
+deny 13459
+deny 13474
+deny 13489
+deny 13495
+deny 13514
+deny 13521 - 13522
+deny 13544
+deny 13579
+deny 13584 - 13585
+deny 13591
+deny 13643
+deny 13679
+deny 13682
+deny 13761
+deny 13774
+deny 13835
+deny 13874
+deny 13878
+deny 13914
+deny 13929
+deny 13934 - 13936
+deny 13991
+deny 13999 - 14000
+deny 14026
+deny 14030
+deny 14069
+deny 14080
+deny 14084
+deny 14087
+deny 14111
+deny 14117
+deny 14122
+deny 14178 - 14179
+deny 14186 - 14187
+deny 14202
+deny 14204
+deny 14231 - 14232
+deny 14234
+deny 14249 - 14250
+deny 14259
+deny 14282
+deny 14285 - 14286
+deny 14316
+deny 14318
+deny 14339
+deny 14346
+deny 14377
+deny 14420
+deny 14457
+deny 14463
+deny 14522
+deny 14535
+deny 14553
+deny 14560
+deny 14571
+deny 14624
+deny 14650
+deny 14664
+deny 14674
+deny 14692
+deny 14708 - 14709
+deny 14723
+deny 14754
+deny 14759
+deny 14769
+deny 14795
+deny 14840
+deny 14845
+deny 14867 - 14868
+deny 14886
+deny 14966
+deny 14970
+deny 15030
+deny 15034
+deny 15064
+deny 15066
+deny 15075
+deny 15078
+deny 15107
+deny 15125
+deny 15151
+deny 15180
+deny 15201
+deny 15208
+deny 15236
+deny 15241
+deny 15246
+deny 15252
+deny 15256
+deny 15274
+deny 15311
+deny 16397
+deny 16418
+deny 16471
+deny 16506
+deny 16522
+deny 16528
+deny 16531
+deny 16592
+deny 16594
+deny 16596
+deny 16606 - 16607
+deny 16629
+deny 16663
+deny 16685
+deny 16689
+deny 16701
+deny 16712
+deny 16732
+deny 16735 - 16736
+deny 16742
+deny 16762
+deny 16772
+deny 16780
+deny 16814
+deny 16847
+deny 16849
+deny 16864
+deny 16874
+deny 16885
+deny 16891
+deny 16906
+deny 16911
+deny 16960
+deny 16973
+deny 16975
+deny 16990
+deny 17069
+deny 17072
+deny 17079
+deny 17086
+deny 17108
+deny 17126
+deny 17147
+deny 17182
+deny 17205
+deny 17208
+deny 17222
+deny 17249 - 17250
+deny 17255
+deny 17257
+deny 17287
+deny 17329
+deny 17376
+deny 17379
+deny 17399
+deny 17401
+deny 18449
+deny 18455
+deny 18466
+deny 18479
+deny 18492
+deny 18496
+deny 18532
+deny 18547
+deny 18576
+deny 18579
+deny 18592
+deny 18644
+deny 18667
+deny 18678
+deny 18734
+deny 18739
+deny 18782
+deny 18809
+deny 18822
+deny 18836
+deny 18840
+deny 18846
+deny 18869
+deny 18881
+deny 18941
+deny 18998
+deny 19033
+deny 19037 - 19038
+deny 19064
+deny 19077
+deny 19089 - 19090
+deny 19109
+deny 19114
+deny 19132
+deny 19169
+deny 19180
+deny 19182
+deny 19192
+deny 19196
+deny 19200
+deny 19228
+deny 19244
+deny 19259
+deny 19278
+deny 19315
+deny 19332
+deny 19338
+deny 19361
+deny 19373
+deny 19411
+deny 19422
+deny 19429
+deny 19447
+deny 19519
+deny 19553
+deny 19582 - 19583
+deny 19611
+deny 19632
+deny 19688
+deny 19723
+deny 19731
+deny 19763
+deny 19767
+deny 19863
+deny 19873
+deny 19889
+deny 19960
+deny 19978
+deny 19989 - 19990
+deny 20002
+deny 20015
+deny 20032
+deny 20043 - 20044
+deny 20106
+deny 20116 - 20117
+deny 20121
+deny 20142
+deny 20173
+deny 20191
+deny 20207
+deny 20232
+deny 20244
+deny 20255 - 20256
+deny 20266
+deny 20297
+deny 20299
+deny 20305
+deny 20312
+deny 20321
+deny 20345
+deny 20361
+deny 20363
+deny 20418
+deny 21506
+deny 21520
+deny 21571
+deny 21574 - 21575
+deny 21578
+deny 21590
+deny 21599
+deny 21603
+deny 21612
+deny 21614
+deny 21674
+deny 21692
+deny 21741
+deny 21753
+deny 21756
+deny 21765
+deny 21768
+deny 21824
+deny 21826
+deny 21838
+deny 21862
+deny 21883
+deny 21888
+deny 21911
+deny 21917
+deny 21980
+deny 22010 - 22011
+deny 22019
+deny 22047
+deny 22055
+deny 22080
+deny 22085
+deny 22092
+deny 22122
+deny 22128 - 22129
+deny 22133
+deny 22148
+deny 22177
+deny 22185
+deny 22227
+deny 22250
+deny 22305
+deny 22313
+deny 22341
+deny 22356
+deny 22368
+deny 22371
+deny 22381 - 22382
+deny 22407
+deny 22411
+deny 22431
+deny 22453
+deny 22501
+deny 22508
+deny 22515
+deny 22529
+deny 22541
+deny 22548
+deny 22566
+deny 22628
+deny 22661
+deny 22678
+deny 22689
+deny 22698 - 22699
+deny 22706
+deny 22724
+deny 22726
+deny 22745
+deny 22798
+deny 22818 - 22819
+deny 22833
+deny 22860
+deny 22869
+deny 22876
+deny 22882
+deny 22884
+deny 22889
+deny 22894
+deny 22908
+deny 22924
+deny 22927
+deny 22975
+deny 23002
+deny 23007
+deny 23020
+deny 23031
+deny 23074
+deny 23091
+deny 23105 - 23106
+deny 23113
+deny 23128
+deny 23140
+deny 23201 - 23202
+deny 23216
+deny 23243
+deny 23246
+deny 23289
+deny 23353
+deny 23360
+deny 23382 - 23383
+deny 23416
+deny 23487 - 23488
+deny 23495
+deny 23541
+deny 25607
+deny 25620
+deny 25701
+deny 25705
+deny 25718
+deny 25734
+deny 25812
+deny 25832
+deny 25908
+deny 25927
+deny 25933
+deny 25998
+deny 26048
+deny 26061
+deny 26090
+deny 26104 - 26105
+deny 26107
+deny 26112
+deny 26118 - 26119
+deny 26136
+deny 26162
+deny 26173
+deny 26194
+deny 26210
+deny 26218
+deny 26317
+deny 26418
+deny 26426
+deny 26434
+deny 26473
+deny 26505
+deny 26592 - 26623
+
+# AFRINIC IPv4 resources cannot be transferred to APNIC
+# From https://www.iana.org/assignments/ipv4-address-space/
+deny 41.0.0.0/8
+deny 102.0.0.0/8
+deny 105.0.0.0/8
+deny 154.0.0.0/16
+deny 154.16.0.0/16
+deny 154.65.0.0 - 154.255.255.255
+deny 196.0.0.0 - 196.1.0.255
+deny 196.1.4.0/24
+deny 196.1.7.0 - 196.1.63.255
+deny 196.1.71.0/24
+deny 196.1.74.0 - 196.1.103.255
+deny 196.1.115.0 - 196.1.133.255
+deny 196.1.137.0/24
+deny 196.1.143.0 - 196.1.159.255
+deny 196.1.176.0 - 196.1.255.255
+deny 196.2.2.0/23
+deny 196.2.8.0 - 196.2.255.255
+deny 196.3.14.0/23
+deny 196.3.57.0 - 196.3.64.255
+deny 196.3.90.0/24
+deny 196.3.92.0 - 196.3.94.255
+deny 196.3.96.0/21
+deny 196.3.105.0/24
+deny 196.3.107.0 - 196.3.131.255
+deny 196.3.148.0/22
+deny 196.3.154.0 - 196.3.183.255
+deny 196.3.224.0 - 196.4.45.255
+deny 196.4.71.0 - 196.11.171.255
+deny 196.11.174.0 - 196.11.239.255
+deny 196.11.248.0/21
+deny 196.12.10.0 - 196.12.31.255
+deny 196.12.128.0/19
+deny 196.12.192.0 - 196.15.15.255
+deny 196.15.64.0 - 196.26.255.255
+deny 196.27.64.0 - 196.28.47.255
+deny 196.28.64.0 - 196.29.63.255
+deny 196.29.96.0 - 196.31.255.255
+deny 196.32.8.0 - 196.32.31.255
+deny 196.32.96.0/19
+deny 196.32.160.0 - 196.39.255.255
+deny 196.40.96.0 - 196.41.255.255
+deny 196.42.64.0 - 196.216.0.255
+deny 196.216.2.0 - 197.255.255.255
+
+# AFRINIC ASNs cannot be transferred to APNIC
+# From https://www.iana.org/assignments/as-numbers/
+deny 36864 - 37887
+deny 327680 - 330751
+
+# AFRINIC ASNs cannot be transferred to APNIC
+# From nro-delegated-stats 20240417
+deny 1228 - 1232
+deny 2018
+deny 2561
+deny 2905
+deny 3067 - 3068
+deny 3208
+deny 3741
+deny 4178
+deny 4571
+deny 5536
+deny 5713
+deny 5734
+deny 6083
+deny 6089
+deny 6127
+deny 6149
+deny 6180
+deny 6187
+deny 6351
+deny 6529
+deny 6560
+deny 6713
+deny 6879
+deny 6968
+deny 7020
+deny 7154
+deny 7231
+deny 7390
+deny 7420
+deny 7460
+deny 7971 - 7972
+deny 8094
+deny 8524
+deny 8770
+deny 9129
+deny 10247
+deny 10262
+deny 10331
+deny 10393
+deny 10474
+deny 10505
+deny 10540
+deny 10575
+deny 10798
+deny 10803
+deny 10898
+deny 11125
+deny 11157
+deny 11201
+deny 11259
+deny 11265
+deny 11380
+deny 11569
+deny 11645
+deny 11744
+deny 11845
+deny 11909
+deny 12091
+deny 12143
+deny 12258
+deny 12455
+deny 12556
+deny 13224
+deny 13402
+deny 13519
+deny 13569
+deny 13854
+deny 14029
+deny 14115
+deny 14331
+deny 14429
+deny 14516
+deny 14988
+deny 15022
+deny 15159
+deny 15399
+deny 15475
+deny 15706
+deny 15804
+deny 15825
+deny 15834
+deny 15964
+deny 16058
+deny 16214
+deny 16284
+deny 16416
+deny 16547
+deny 16630
+deny 16637
+deny 16800
+deny 16853
+deny 16907
+deny 17148
+deny 17220
+deny 17260
+deny 17312
+deny 17400
+deny 17652
+deny 18775
+deny 18922
+deny 18931
+deny 19136
+deny 19232
+deny 19676
+deny 19711
+deny 19832
+deny 19847
+deny 20011
+deny 20086
+deny 20095
+deny 20180
+deny 20294
+deny 20459
+deny 20484
+deny 20858
+deny 20928
+deny 21003
+deny 21152
+deny 21242
+deny 21271
+deny 21278
+deny 21280
+deny 21391
+deny 21452
+deny 21739
+deny 21819
+deny 22354 - 22355
+deny 22386
+deny 22572
+deny 22690
+deny 22735
+deny 22750
+deny 22939
+deny 23058
+deny 23549
+deny 23889
+deny 24736
+deny 24757
+deny 24788
+deny 24801
+deny 24835
+deny 24863
+deny 24878
+deny 24987
+deny 25163
+deny 25250
+deny 25362
+deny 25364
+deny 25543
+deny 25568
+deny 25576
+deny 25695
+deny 25726
+deny 25793
+deny 25818
+deny 26106
+deny 26130
+deny 26422
+deny 26625
+deny 26754
+deny 27576
+deny 27598
+deny 28683
+deny 28698
+deny 28913
+deny 29091
+deny 29338
+deny 29340
+deny 29428
+deny 29495
+deny 29544
+deny 29571
+deny 29614
+deny 29674
+deny 29918
+deny 29975
+deny 30073
+deny 30306
+deny 30429
+deny 30619
+deny 30896
+deny 30980
+deny 30982 - 30999
+deny 31065
+deny 31245
+deny 31619
+deny 31810
+deny 31856
+deny 31960
+deny 32017
+deny 32279
+deny 32398
+deny 32437
+deny 32653
+deny 32714
+deny 32717
+deny 32842
+deny 32860
+deny 33567
+deny 33579
+deny 33762 - 33791
+
+# Private use IPv4 & IPv6 addresses and ASNs
+deny 0.0.0.0/8               # RFC 1122 Local Identification
+deny 10.0.0.0/8              # RFC 1918 private space
+deny 100.64.0.0/10           # RFC 6598 Carrier Grade NAT
+deny 127.0.0.0/8             # RFC 1122 localhost
+deny 169.254.0.0/16          # RFC 3927 link local
+deny 172.16.0.0/12           # RFC 1918 private space
+deny 192.0.2.0/24            # RFC 5737 TEST-NET-1
+deny 192.88.99.0/24          # RFC 7526 6to4 anycast relay
+deny 192.168.0.0/16          # RFC 1918 private space
+deny 198.18.0.0/15           # RFC 2544 benchmarking
+deny 198.51.100.0/24         # RFC 5737 TEST-NET-2
+deny 203.0.113.0/24          # RFC 5737 TEST-NET-3
+deny 224.0.0.0/4             # Multicast
+deny 240.0.0.0/4             # Reserved
+deny 23456                   # RFC 4893 AS_TRANS
+deny 64496 - 64511           # RFC 5398
+deny 64512 - 65534           # RFC 6996
+deny 65535                   # RFC 7300
+deny 65536 - 65551           # RFC 5398
+deny 65552 - 131071          # IANA Reserved
+deny 4200000000 - 4294967294 # RFC 6996
+deny 4294967295              # RFC 7300
+
+# APNIC supports IPv4 and ASN transfers: allow the complement of what is denied
+allow 0.0.0.0/0
+allow 1 - 4199999999
diff --git a/tals/apnic.tal b/tals/apnic.tal
new file mode 100644
index 0000000..803eb20
--- /dev/null
+++ b/tals/apnic.tal
@@ -0,0 +1,10 @@
+https://rpki.apnic.net/repository/apnic-rpki-root-iana-origin.cer
+rsync://rpki.apnic.net/repository/apnic-rpki-root-iana-origin.cer
+
+MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAx9RWSL61YAAYumEiU8z8
+qH2ETVIL01ilxZlzIL9JYSORMN5Cmtf8V2JblIealSqgOTGjvSjEsiV73s67zYQI
+7C/iSOb96uf3/s86NqbxDiFQGN8qG7RNcdgVuUlAidl8WxvLNI8VhqbAB5uSg/Mr
+LeSOvXRja041VptAxIhcGzDMvlAJRwkrYK/Mo8P4E2rSQgwqCgae0ebY1CsJ3Cjf
+i67C1nw7oXqJJovvXJ4apGmEv8az23OLC6Ki54Ul/E6xk227BFttqFV3YMtKx42H
+cCcDVZZy01n7JjzvO8ccaXmHIgR7utnqhBRNNq5Xc5ZhbkrUsNtiJmrZzVlgU6Ou
+0wIDAQAB
diff --git a/tals/arin.constraints b/tals/arin.constraints
new file mode 100644
index 0000000..1bc3097
--- /dev/null
+++ b/tals/arin.constraints
@@ -0,0 +1,981 @@
+#	$OpenBSD: arin.constraints,v 1.7 2026/07/09 12:29:52 job Exp $
+
+# From https://www.iana.org/assignments/ipv6-unicast-address-assignments
+allow 2001:400::/23
+allow 2001:1800::/23
+allow 2001:4800::/23
+allow 2600::/12
+allow 2610::/23
+allow 2620::/23
+allow 2630::/12
+
+# AS112 Project
+allow 2001:4:112::/48
+
+# LACNIC ASNs cannot be transferred to ARIN
+# From https://www.iana.org/assignments/as-numbers/as-numbers.xhtml
+deny 27648 - 28671
+deny 52224 - 53247
+deny 61440 - 61951
+deny 64099 - 64197
+deny 262144 - 275868
+
+# LACNIC ASNs cannot be transferred to ARIN
+# From nro-delegated-stats 20240417
+deny 278
+deny 676
+deny 1251
+deny 1292
+deny 1296
+deny 1797
+deny 1831
+deny 1840
+deny 1916
+deny 2146
+deny 2277
+deny 2549
+deny 2638
+deny 2708
+deny 2715 - 2716
+deny 2739
+deny 2904
+deny 3132
+deny 3141
+deny 3449
+deny 3454
+deny 3484
+deny 3487
+deny 3496
+deny 3548
+deny 3551
+deny 3556
+deny 3596 - 3597
+deny 3603
+deny 3631 - 3632
+deny 3636
+deny 3640
+deny 3790
+deny 3816
+deny 3905
+deny 3968
+deny 4141
+deny 4209
+deny 4230
+deny 4242
+deny 4244
+deny 4270
+deny 4387
+deny 4493
+deny 4535
+deny 4914
+deny 4926
+deny 4944
+deny 4964
+deny 4967
+deny 4995
+deny 5005
+deny 5633
+deny 5639
+deny 5648
+deny 5692
+deny 5708
+deny 5722
+deny 5745
+deny 5772
+deny 6057
+deny 6063 - 6065
+deny 6084
+deny 6121
+deny 6125
+deny 6133
+deny 6135
+deny 6147 - 6148
+deny 6193
+deny 6240
+deny 6306
+deny 6332
+deny 6342
+deny 6400
+deny 6429
+deny 6458
+deny 6471
+deny 6487
+deny 6495
+deny 6503
+deny 6505
+deny 6535
+deny 6543
+deny 6545
+deny 6568
+deny 6590
+deny 6927
+deny 6945
+deny 6957
+deny 7002
+deny 7004 - 7005
+deny 7038
+deny 7048 - 7049
+deny 7056
+deny 7063
+deny 7080
+deny 7087
+deny 7103
+deny 7120
+deny 7125
+deny 7137
+deny 7149
+deny 7157
+deny 7162
+deny 7167
+deny 7173
+deny 7184
+deny 7195
+deny 7199
+deny 7236
+deny 7298
+deny 7303
+deny 7313
+deny 7315
+deny 7325
+deny 7340
+deny 7365
+deny 7399
+deny 7408
+deny 7414
+deny 7417 - 7418
+deny 7428
+deny 7437 - 7438
+deny 7465
+deny 7727
+deny 7738
+deny 7803
+deny 7864
+deny 7890
+deny 7906
+deny 7908
+deny 7910
+deny 7927
+deny 7934
+deny 7953
+deny 7965
+deny 7974
+deny 7980
+deny 7984
+deny 7993 - 7995
+deny 7997
+deny 8007
+deny 8024
+deny 8026
+deny 8048
+deny 8053 - 8056
+deny 8065 - 8066
+deny 8096
+deny 8140 - 8141
+deny 8151
+deny 8163
+deny 8167
+deny 8178
+deny 10269
+deny 10277
+deny 10285
+deny 10293
+deny 10299
+deny 10301
+deny 10318
+deny 10362
+deny 10391
+deny 10412
+deny 10417
+deny 10420
+deny 10429
+deny 10436
+deny 10452
+deny 10454
+deny 10463
+deny 10476
+deny 10479
+deny 10481
+deny 10495
+deny 10502
+deny 10531
+deny 10560
+deny 10569
+deny 10586
+deny 10600
+deny 10605 - 10606
+deny 10617
+deny 10620
+deny 10624
+deny 10630
+deny 10640
+deny 10649
+deny 10670 - 10671
+deny 10688
+deny 10691
+deny 10697
+deny 10704
+deny 10706
+deny 10715
+deny 10733
+deny 10757
+deny 10778
+deny 10785
+deny 10795
+deny 10824
+deny 10834
+deny 10841
+deny 10847
+deny 10875
+deny 10881
+deny 10895
+deny 10897
+deny 10906
+deny 10938
+deny 10954
+deny 10964
+deny 10983
+deny 10986
+deny 10992
+deny 11008
+deny 11014
+deny 11053
+deny 11058
+deny 11063
+deny 11081
+deny 11083
+deny 11087
+deny 11097
+deny 11136
+deny 11172
+deny 11193
+deny 11237
+deny 11242
+deny 11254
+deny 11256
+deny 11271
+deny 11284
+deny 11295
+deny 11311
+deny 11315
+deny 11335
+deny 11338
+deny 11340
+deny 11356
+deny 11373
+deny 11390
+deny 11392
+deny 11411
+deny 11415
+deny 11419
+deny 11431 - 11432
+deny 11447
+deny 11450 - 11451
+deny 11497 - 11498
+deny 11503
+deny 11514
+deny 11519
+deny 11556
+deny 11562
+deny 11571
+deny 11581
+deny 11585
+deny 11592
+deny 11599
+deny 11617
+deny 11642
+deny 11644
+deny 11664
+deny 11673
+deny 11677
+deny 11694
+deny 11706
+deny 11750 - 11752
+deny 11786
+deny 11800 - 11802
+deny 11815 - 11816
+deny 11830
+deny 11835
+deny 11844
+deny 11888
+deny 11896
+deny 11921
+deny 11947
+deny 11960
+deny 11993
+deny 12034
+deny 12066
+deny 12127
+deny 12135 - 12136
+deny 12140
+deny 12146
+deny 12150
+deny 12248
+deny 12252
+deny 12264
+deny 13316
+deny 13318
+deny 13320
+deny 13353
+deny 13357
+deny 13381
+deny 13424
+deny 13440
+deny 13459
+deny 13474
+deny 13489
+deny 13495
+deny 13514
+deny 13521 - 13522
+deny 13544
+deny 13579
+deny 13584 - 13585
+deny 13591
+deny 13643
+deny 13679
+deny 13682
+deny 13761
+deny 13774
+deny 13835
+deny 13874
+deny 13878
+deny 13914
+deny 13929
+deny 13934 - 13936
+deny 13991
+deny 13999 - 14000
+deny 14026
+deny 14030
+deny 14069
+deny 14080
+deny 14084
+deny 14087
+deny 14111
+deny 14117
+deny 14122
+deny 14178 - 14179
+deny 14186 - 14187
+deny 14202
+deny 14204
+deny 14231 - 14232
+deny 14234
+deny 14249 - 14250
+deny 14259
+deny 14282
+deny 14285 - 14286
+deny 14316
+deny 14318
+deny 14339
+deny 14346
+deny 14377
+deny 14420
+deny 14457
+deny 14463
+deny 14522
+deny 14535
+deny 14553
+deny 14560
+deny 14571
+deny 14624
+deny 14650
+deny 14664
+deny 14674
+deny 14692
+deny 14708 - 14709
+deny 14723
+deny 14754
+deny 14759
+deny 14769
+deny 14795
+deny 14840
+deny 14845
+deny 14867 - 14868
+deny 14886
+deny 14966
+deny 14970
+deny 15030
+deny 15034
+deny 15064
+deny 15066
+deny 15075
+deny 15078
+deny 15107
+deny 15125
+deny 15151
+deny 15180
+deny 15201
+deny 15208
+deny 15236
+deny 15241
+deny 15246
+deny 15252
+deny 15256
+deny 15274
+deny 15311
+deny 16397
+deny 16418
+deny 16471
+deny 16506
+deny 16522
+deny 16528
+deny 16531
+deny 16592
+deny 16594
+deny 16596
+deny 16606 - 16607
+deny 16629
+deny 16663
+deny 16685
+deny 16689
+deny 16701
+deny 16712
+deny 16732
+deny 16735 - 16736
+deny 16742
+deny 16762
+deny 16772
+deny 16780
+deny 16814
+deny 16847
+deny 16849
+deny 16864
+deny 16874
+deny 16885
+deny 16891
+deny 16906
+deny 16911
+deny 16960
+deny 16973
+deny 16975
+deny 16990
+deny 17069
+deny 17072
+deny 17079
+deny 17086
+deny 17108
+deny 17126
+deny 17147
+deny 17182
+deny 17205
+deny 17208
+deny 17222
+deny 17249 - 17250
+deny 17255
+deny 17257
+deny 17287
+deny 17329
+deny 17376
+deny 17379
+deny 17399
+deny 17401
+deny 18449
+deny 18455
+deny 18466
+deny 18479
+deny 18492
+deny 18496
+deny 18532
+deny 18547
+deny 18576
+deny 18579
+deny 18592
+deny 18644
+deny 18667
+deny 18678
+deny 18734
+deny 18739
+deny 18782
+deny 18809
+deny 18822
+deny 18836
+deny 18840
+deny 18846
+deny 18869
+deny 18881
+deny 18941
+deny 18998
+deny 19033
+deny 19037 - 19038
+deny 19064
+deny 19077
+deny 19089 - 19090
+deny 19109
+deny 19114
+deny 19132
+deny 19169
+deny 19180
+deny 19182
+deny 19192
+deny 19196
+deny 19200
+deny 19228
+deny 19244
+deny 19259
+deny 19278
+deny 19315
+deny 19332
+deny 19338
+deny 19361
+deny 19373
+deny 19411
+deny 19422
+deny 19429
+deny 19447
+deny 19519
+deny 19553
+deny 19582 - 19583
+deny 19611
+deny 19632
+deny 19688
+deny 19723
+deny 19731
+deny 19763
+deny 19767
+deny 19863
+deny 19873
+deny 19889
+deny 19960
+deny 19978
+deny 19989 - 19990
+deny 20002
+deny 20015
+deny 20032
+deny 20043 - 20044
+deny 20106
+deny 20116 - 20117
+deny 20121
+deny 20142
+deny 20173
+deny 20191
+deny 20207
+deny 20232
+deny 20244
+deny 20255 - 20256
+deny 20266
+deny 20297
+deny 20299
+deny 20305
+deny 20312
+deny 20321
+deny 20345
+deny 20361
+deny 20363
+deny 20418
+deny 21506
+deny 21520
+deny 21571
+deny 21574 - 21575
+deny 21578
+deny 21590
+deny 21599
+deny 21603
+deny 21612
+deny 21614
+deny 21674
+deny 21692
+deny 21741
+deny 21753
+deny 21756
+deny 21765
+deny 21768
+deny 21824
+deny 21826
+deny 21838
+deny 21862
+deny 21883
+deny 21888
+deny 21911
+deny 21917
+deny 21980
+deny 22010 - 22011
+deny 22019
+deny 22047
+deny 22055
+deny 22080
+deny 22085
+deny 22092
+deny 22122
+deny 22128 - 22129
+deny 22133
+deny 22148
+deny 22177
+deny 22185
+deny 22227
+deny 22250
+deny 22305
+deny 22313
+deny 22341
+deny 22356
+deny 22368
+deny 22371
+deny 22381 - 22382
+deny 22407
+deny 22411
+deny 22431
+deny 22453
+deny 22501
+deny 22508
+deny 22515
+deny 22529
+deny 22541
+deny 22548
+deny 22566
+deny 22628
+deny 22661
+deny 22678
+deny 22689
+deny 22698 - 22699
+deny 22706
+deny 22724
+deny 22726
+deny 22745
+deny 22798
+deny 22818 - 22819
+deny 22833
+deny 22860
+deny 22869
+deny 22876
+deny 22882
+deny 22884
+deny 22889
+deny 22894
+deny 22908
+deny 22924
+deny 22927
+deny 22975
+deny 23002
+deny 23007
+deny 23020
+deny 23031
+deny 23074
+deny 23091
+deny 23105 - 23106
+deny 23113
+deny 23128
+deny 23140
+deny 23201 - 23202
+deny 23216
+deny 23243
+deny 23246
+deny 23289
+deny 23353
+deny 23360
+deny 23382 - 23383
+deny 23416
+deny 23487 - 23488
+deny 23495
+deny 23541
+deny 25607
+deny 25620
+deny 25701
+deny 25705
+deny 25718
+deny 25734
+deny 25812
+deny 25832
+deny 25908
+deny 25927
+deny 25933
+deny 25998
+deny 26048
+deny 26061
+deny 26090
+deny 26104 - 26105
+deny 26107
+deny 26112
+deny 26118 - 26119
+deny 26136
+deny 26162
+deny 26173
+deny 26194
+deny 26210
+deny 26218
+deny 26317
+deny 26418
+deny 26426
+deny 26434
+deny 26473
+deny 26505
+deny 26592 - 26623
+
+# AFRINIC IPv4 resources cannot be transferred to ARIN
+# From https://www.iana.org/assignments/ipv4-address-space/
+deny 41.0.0.0/8
+deny 102.0.0.0/8
+deny 105.0.0.0/8
+deny 154.0.0.0/16
+deny 154.16.0.0/16
+deny 154.65.0.0 - 154.255.255.255
+deny 196.0.0.0 - 196.1.0.255
+deny 196.1.4.0/24
+deny 196.1.7.0 - 196.1.63.255
+deny 196.1.71.0/24
+deny 196.1.74.0 - 196.1.103.255
+deny 196.1.115.0 - 196.1.133.255
+deny 196.1.137.0/24
+deny 196.1.143.0 - 196.1.159.255
+deny 196.1.176.0 - 196.1.255.255
+deny 196.2.2.0/23
+deny 196.2.8.0 - 196.2.255.255
+deny 196.3.14.0/23
+deny 196.3.57.0 - 196.3.64.255
+deny 196.3.90.0/24
+deny 196.3.92.0 - 196.3.94.255
+deny 196.3.96.0/21
+deny 196.3.105.0/24
+deny 196.3.107.0 - 196.3.131.255
+deny 196.3.148.0/22
+deny 196.3.154.0 - 196.3.183.255
+deny 196.3.224.0 - 196.4.45.255
+deny 196.4.71.0 - 196.11.171.255
+deny 196.11.174.0 - 196.11.239.255
+deny 196.11.248.0/21
+deny 196.12.10.0 - 196.12.31.255
+deny 196.12.128.0/19
+deny 196.12.192.0 - 196.15.15.255
+deny 196.15.64.0 - 196.26.255.255
+deny 196.27.64.0 - 196.28.47.255
+deny 196.28.64.0 - 196.29.63.255
+deny 196.29.96.0 - 196.31.255.255
+deny 196.32.8.0 - 196.32.31.255
+deny 196.32.96.0/19
+deny 196.32.160.0 - 196.39.255.255
+deny 196.40.96.0 - 196.41.255.255
+deny 196.42.64.0 - 196.216.0.255
+deny 196.216.2.0 - 197.255.255.255
+
+# AFRINIC ASNs cannot be transferred to ARIN
+# From https://www.iana.org/assignments/as-numbers/
+deny 36864 - 37887
+deny 327680 - 330751
+
+# AFRINIC ASNs cannot be transferred to ARIN
+# From nro-delegated-stats 20240417
+deny 1228 - 1232
+deny 2018
+deny 2561
+deny 2905
+deny 3067 - 3068
+deny 3208
+deny 3741
+deny 4178
+deny 4571
+deny 5536
+deny 5713
+deny 5734
+deny 6083
+deny 6089
+deny 6127
+deny 6149
+deny 6180
+deny 6187
+deny 6351
+deny 6529
+deny 6560
+deny 6713
+deny 6879
+deny 6968
+deny 7020
+deny 7154
+deny 7231
+deny 7390
+deny 7420
+deny 7460
+deny 7971 - 7972
+deny 8094
+deny 8524
+deny 8770
+deny 9129
+deny 10247
+deny 10262
+deny 10331
+deny 10393
+deny 10474
+deny 10505
+deny 10540
+deny 10575
+deny 10798
+deny 10803
+deny 10898
+deny 11125
+deny 11157
+deny 11201
+deny 11259
+deny 11265
+deny 11380
+deny 11569
+deny 11645
+deny 11744
+deny 11845
+deny 11909
+deny 12091
+deny 12143
+deny 12258
+deny 12455
+deny 12556
+deny 13224
+deny 13402
+deny 13519
+deny 13569
+deny 13854
+deny 14029
+deny 14115
+deny 14331
+deny 14429
+deny 14516
+deny 14988
+deny 15022
+deny 15159
+deny 15399
+deny 15475
+deny 15706
+deny 15804
+deny 15825
+deny 15834
+deny 15964
+deny 16058
+deny 16214
+deny 16284
+deny 16416
+deny 16547
+deny 16630
+deny 16637
+deny 16800
+deny 16853
+deny 16907
+deny 17148
+deny 17220
+deny 17260
+deny 17312
+deny 17400
+deny 17652
+deny 18775
+deny 18922
+deny 18931
+deny 19136
+deny 19232
+deny 19676
+deny 19711
+deny 19832
+deny 19847
+deny 20011
+deny 20086
+deny 20095
+deny 20180
+deny 20294
+deny 20459
+deny 20484
+deny 20858
+deny 20928
+deny 21003
+deny 21152
+deny 21242
+deny 21271
+deny 21278
+deny 21280
+deny 21391
+deny 21452
+deny 21739
+deny 21819
+deny 22354 - 22355
+deny 22386
+deny 22572
+deny 22690
+deny 22735
+deny 22750
+deny 22939
+deny 23058
+deny 23549
+deny 23889
+deny 24736
+deny 24757
+deny 24788
+deny 24801
+deny 24835
+deny 24863
+deny 24878
+deny 24987
+deny 25163
+deny 25250
+deny 25362
+deny 25364
+deny 25543
+deny 25568
+deny 25576
+deny 25695
+deny 25726
+deny 25793
+deny 25818
+deny 26106
+deny 26130
+deny 26422
+deny 26625
+deny 26754
+deny 27576
+deny 27598
+deny 28683
+deny 28698
+deny 28913
+deny 29091
+deny 29338
+deny 29340
+deny 29428
+deny 29495
+deny 29544
+deny 29571
+deny 29614
+deny 29674
+deny 29918
+deny 29975
+deny 30073
+deny 30306
+deny 30429
+deny 30619
+deny 30896
+deny 30980
+deny 30982 - 30999
+deny 31065
+deny 31245
+deny 31619
+deny 31810
+deny 31856
+deny 31960
+deny 32017
+deny 32279
+deny 32398
+deny 32437
+deny 32653
+deny 32714
+deny 32717
+deny 32842
+deny 32860
+deny 33567
+deny 33579
+deny 33762 - 33791
+
+# Private use IPv4 & IPv6 addresses and ASNs
+deny 0.0.0.0/8               # RFC 1122 Local Identification
+deny 10.0.0.0/8              # RFC 1918 private space
+deny 100.64.0.0/10           # RFC 6598 Carrier Grade NAT
+deny 127.0.0.0/8             # RFC 1122 localhost
+deny 169.254.0.0/16          # RFC 3927 link local
+deny 172.16.0.0/12           # RFC 1918 private space
+deny 192.0.2.0/24            # RFC 5737 TEST-NET-1
+deny 192.88.99.0/24          # RFC 7526 6to4 anycast relay
+deny 192.168.0.0/16          # RFC 1918 private space
+deny 198.18.0.0/15           # RFC 2544 benchmarking
+deny 198.51.100.0/24         # RFC 5737 TEST-NET-2
+deny 203.0.113.0/24          # RFC 5737 TEST-NET-3
+deny 224.0.0.0/4             # Multicast
+deny 240.0.0.0/4             # Reserved
+deny 23456                   # RFC 4893 AS_TRANS
+deny 64496 - 64511           # RFC 5398
+deny 64512 - 65534           # RFC 6996
+deny 65535                   # RFC 7300
+deny 65536 - 65551           # RFC 5398
+deny 65552 - 131071          # IANA Reserved
+deny 4200000000 - 4294967294 # RFC 6996
+deny 4294967295              # RFC 7300
+
+# ARIN supports IPv4 and ASN transfers: allow the complement of what is denied
+allow 0.0.0.0/0
+allow 1 - 4199999999
diff --git a/tals/arin.tal b/tals/arin.tal
new file mode 100644
index 0000000..eebfa80
--- /dev/null
+++ b/tals/arin.tal
@@ -0,0 +1,20 @@
+# THIS TRUST ANCHOR LOCATOR IS PROVIDED BY THE AMERICAN REGISTRY FOR
+# INTERNET NUMBERS (ARIN) "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES,
+# INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+# IN NO EVENT SHALL ARIN BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS PUBLIC KEY, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+https://rrdp.arin.net/arin-rpki-ta.cer
+rsync://rpki.arin.net/repository/arin-rpki-ta.cer
+
+MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA3lZPjbHvMRV5sDDqfLc/685th5Fn
+reHMJjg8pEZUbG8Y8TQxSBsDebbsDpl3Ov3Cj1WtdrJ3CIfQODCPrrJdOBSrMATeUbPC+JlN
+f2SRP3UB+VJFgtTj0RN8cEYIuhBW5t6AxQbHhdNQH+A1F/OJdw0q9da2U29Lx85nfFxvnC1E
+pK9CbLJS4m37+RlpNbT1cba+b+loXpx0Qcb1C4UpJCGDy7uNf5w6/+l7RpATAHqqsX4qCtww
+DYlbHzp2xk9owF3mkCxzl0HwncO+sEHHeaL3OjtwdIGrRGeHi2Mpt+mvWHhtQqVG+51MHTyg
++nIjWFKKGx1Q9+KDx4wJStwveQIDAQAB
diff --git a/tals/lacnic.constraints b/tals/lacnic.constraints
new file mode 100644
index 0000000..f8f6435
--- /dev/null
+++ b/tals/lacnic.constraints
@@ -0,0 +1,753 @@
+#	$OpenBSD: lacnic.constraints,v 1.8 2025/11/23 00:29:18 tb Exp $
+
+# From https://www.iana.org/assignments/ipv6-unicast-address-assignments
+allow 2001:1200::/23
+allow 2800::/12
+
+# From https://www.iana.org/assignments/as-numbers/
+allow 27648 - 28671
+allow 52224 - 53247
+allow 61440 - 61951
+allow 64099 - 64197
+allow 262144 - 275868
+
+# From nro-delegated-stats 20240417
+allow 278
+allow 676
+allow 1251
+allow 1292
+allow 1296
+allow 1797
+allow 1831
+allow 1840
+allow 1916
+allow 2146
+allow 2277
+allow 2549
+allow 2638
+allow 2708
+allow 2715 - 2716
+allow 2739
+allow 2904
+allow 3132
+allow 3141
+allow 3449
+allow 3454
+allow 3484
+allow 3487
+allow 3496
+allow 3548
+allow 3551
+allow 3556
+allow 3596 - 3597
+allow 3603
+allow 3631 - 3632
+allow 3636
+allow 3640
+allow 3790
+allow 3816
+allow 3905
+allow 3968
+allow 4141
+allow 4209
+allow 4230
+allow 4242
+allow 4244
+allow 4270
+allow 4387
+allow 4493
+allow 4535
+allow 4914
+allow 4926
+allow 4944
+allow 4964
+allow 4967
+allow 4995
+allow 5005
+allow 5633
+allow 5639
+allow 5648
+allow 5692
+allow 5708
+allow 5722
+allow 5745
+allow 5772
+allow 6057
+allow 6063 - 6065
+allow 6084
+allow 6121
+allow 6125
+allow 6133
+allow 6135
+allow 6147 - 6148
+allow 6193
+allow 6240
+allow 6306
+allow 6332
+allow 6342
+allow 6400
+allow 6429
+allow 6458
+allow 6471
+allow 6487
+allow 6495
+allow 6503
+allow 6505
+allow 6535
+allow 6543
+allow 6545
+allow 6568
+allow 6590
+allow 6927
+allow 6945
+allow 6957
+allow 7002
+allow 7004 - 7005
+allow 7038
+allow 7048 - 7049
+allow 7056
+allow 7063
+allow 7080
+allow 7087
+allow 7103
+allow 7120
+allow 7125
+allow 7137
+allow 7149
+allow 7157
+allow 7162
+allow 7167
+allow 7173
+allow 7184
+allow 7195
+allow 7199
+allow 7236
+allow 7298
+allow 7303
+allow 7313
+allow 7315
+allow 7325
+allow 7340
+allow 7365
+allow 7399
+allow 7408
+allow 7414
+allow 7417 - 7418
+allow 7428
+allow 7437 - 7438
+allow 7465
+allow 7727
+allow 7738
+allow 7803
+allow 7864
+allow 7890
+allow 7906
+allow 7908
+allow 7910
+allow 7927
+allow 7934
+allow 7953
+allow 7965
+allow 7974
+allow 7980
+allow 7984
+allow 7993 - 7995
+allow 7997
+allow 8007
+allow 8024
+allow 8026
+allow 8048
+allow 8053 - 8056
+allow 8065 - 8066
+allow 8096
+allow 8140 - 8141
+allow 8151
+allow 8163
+allow 8167
+allow 8178
+allow 10269
+allow 10277
+allow 10285
+allow 10293
+allow 10299
+allow 10301
+allow 10318
+allow 10362
+allow 10391
+allow 10412
+allow 10417
+allow 10420
+allow 10429
+allow 10436
+allow 10452
+allow 10454
+allow 10463
+allow 10476
+allow 10479
+allow 10481
+allow 10495
+allow 10502
+allow 10531
+allow 10560
+allow 10569
+allow 10586
+allow 10600
+allow 10605 - 10606
+allow 10617
+allow 10620
+allow 10624
+allow 10630
+allow 10640
+allow 10649
+allow 10670 - 10671
+allow 10688
+allow 10691
+allow 10697
+allow 10704
+allow 10706
+allow 10715
+allow 10733
+allow 10757
+allow 10778
+allow 10785
+allow 10795
+allow 10824
+allow 10834
+allow 10841
+allow 10847
+allow 10875
+allow 10881
+allow 10895
+allow 10897
+allow 10906
+allow 10938
+allow 10954
+allow 10964
+allow 10983
+allow 10986
+allow 10992
+allow 11008
+allow 11014
+allow 11053
+allow 11058
+allow 11063
+allow 11081
+allow 11083
+allow 11087
+allow 11097
+allow 11136
+allow 11172
+allow 11193
+allow 11237
+allow 11242
+allow 11254
+allow 11256
+allow 11271
+allow 11284
+allow 11295
+allow 11311
+allow 11315
+allow 11335
+allow 11338
+allow 11340
+allow 11356
+allow 11373
+allow 11390
+allow 11392
+allow 11411
+allow 11415
+allow 11419
+allow 11431 - 11432
+allow 11447
+allow 11450 - 11451
+allow 11497 - 11498
+allow 11503
+allow 11514
+allow 11519
+allow 11556
+allow 11562
+allow 11571
+allow 11581
+allow 11585
+allow 11592
+allow 11599
+allow 11617
+allow 11642
+allow 11644
+allow 11664
+allow 11673
+allow 11677
+allow 11694
+allow 11706
+allow 11750 - 11752
+allow 11786
+allow 11800 - 11802
+allow 11815 - 11816
+allow 11830
+allow 11835
+allow 11844
+allow 11888
+allow 11896
+allow 11921
+allow 11947
+allow 11960
+allow 11993
+allow 12034
+allow 12066
+allow 12127
+allow 12135 - 12136
+allow 12140
+allow 12146
+allow 12150
+allow 12248
+allow 12252
+allow 12264
+allow 13316
+allow 13318
+allow 13320
+allow 13353
+allow 13357
+allow 13381
+allow 13424
+allow 13440
+allow 13459
+allow 13474
+allow 13489
+allow 13495
+allow 13514
+allow 13521 - 13522
+allow 13544
+allow 13579
+allow 13584 - 13585
+allow 13591
+allow 13643
+allow 13679
+allow 13682
+allow 13761
+allow 13774
+allow 13835
+allow 13874
+allow 13878
+allow 13914
+allow 13929
+allow 13934 - 13936
+allow 13991
+allow 13999 - 14000
+allow 14026
+allow 14030
+allow 14069
+allow 14080
+allow 14084
+allow 14087
+allow 14111
+allow 14117
+allow 14122
+allow 14178 - 14179
+allow 14186 - 14187
+allow 14202
+allow 14204
+allow 14231 - 14232
+allow 14234
+allow 14249 - 14250
+allow 14259
+allow 14282
+allow 14285 - 14286
+allow 14316
+allow 14318
+allow 14339
+allow 14346
+allow 14377
+allow 14420
+allow 14457
+allow 14463
+allow 14522
+allow 14535
+allow 14553
+allow 14560
+allow 14571
+allow 14624
+allow 14650
+allow 14664
+allow 14674
+allow 14692
+allow 14708 - 14709
+allow 14723
+allow 14754
+allow 14759
+allow 14769
+allow 14795
+allow 14840
+allow 14845
+allow 14867 - 14868
+allow 14886
+allow 14966
+allow 14970
+allow 15030
+allow 15034
+allow 15064
+allow 15066
+allow 15075
+allow 15078
+allow 15107
+allow 15125
+allow 15151
+allow 15180
+allow 15201
+allow 15208
+allow 15236
+allow 15241
+allow 15246
+allow 15252
+allow 15256
+allow 15274
+allow 15311
+allow 16397
+allow 16418
+allow 16471
+allow 16506
+allow 16522
+allow 16528
+allow 16531
+allow 16592
+allow 16594
+allow 16596
+allow 16606 - 16607
+allow 16629
+allow 16663
+allow 16685
+allow 16689
+allow 16701
+allow 16712
+allow 16732
+allow 16735 - 16736
+allow 16742
+allow 16762
+allow 16772
+allow 16780
+allow 16814
+allow 16847
+allow 16849
+allow 16864
+allow 16874
+allow 16885
+allow 16891
+allow 16906
+allow 16911
+allow 16960
+allow 16973
+allow 16975
+allow 16990
+allow 17069
+allow 17072
+allow 17079
+allow 17086
+allow 17108
+allow 17126
+allow 17147
+allow 17182
+allow 17205
+allow 17208
+allow 17222
+allow 17249 - 17250
+allow 17255
+allow 17257
+allow 17287
+allow 17329
+allow 17376
+allow 17379
+allow 17399
+allow 17401
+allow 18449
+allow 18455
+allow 18466
+allow 18479
+allow 18492
+allow 18496
+allow 18532
+allow 18547
+allow 18576
+allow 18579
+allow 18592
+allow 18644
+allow 18667
+allow 18678
+allow 18734
+allow 18739
+allow 18782
+allow 18809
+allow 18822
+allow 18836
+allow 18840
+allow 18846
+allow 18869
+allow 18881
+allow 18941
+allow 18998
+allow 19033
+allow 19037 - 19038
+allow 19064
+allow 19077
+allow 19089 - 19090
+allow 19109
+allow 19114
+allow 19132
+allow 19169
+allow 19180
+allow 19182
+allow 19192
+allow 19196
+allow 19200
+allow 19228
+allow 19244
+allow 19259
+allow 19278
+allow 19315
+allow 19332
+allow 19338
+allow 19361
+allow 19373
+allow 19411
+allow 19422
+allow 19429
+allow 19447
+allow 19519
+allow 19553
+allow 19582 - 19583
+allow 19611
+allow 19632
+allow 19688
+allow 19723
+allow 19731
+allow 19763
+allow 19767
+allow 19863
+allow 19873
+allow 19889
+allow 19960
+allow 19978
+allow 19989 - 19990
+allow 20002
+allow 20015
+allow 20032
+allow 20043 - 20044
+allow 20106
+allow 20116 - 20117
+allow 20121
+allow 20142
+allow 20173
+allow 20191
+allow 20207
+allow 20232
+allow 20244
+allow 20255 - 20256
+allow 20266
+allow 20297
+allow 20299
+allow 20305
+allow 20312
+allow 20321
+allow 20345
+allow 20361
+allow 20363
+allow 20418
+allow 21506
+allow 21520
+allow 21571
+allow 21574 - 21575
+allow 21578
+allow 21590
+allow 21599
+allow 21603
+allow 21612
+allow 21614
+allow 21674
+allow 21692
+allow 21741
+allow 21753
+allow 21756
+allow 21765
+allow 21768
+allow 21824
+allow 21826
+allow 21838
+allow 21862
+allow 21883
+allow 21888
+allow 21911
+allow 21917
+allow 21980
+allow 22010 - 22011
+allow 22019
+allow 22047
+allow 22055
+allow 22080
+allow 22085
+allow 22092
+allow 22122
+allow 22128 - 22129
+allow 22133
+allow 22148
+allow 22177
+allow 22185
+allow 22227
+allow 22250
+allow 22305
+allow 22313
+allow 22341
+allow 22356
+allow 22368
+allow 22371
+allow 22381 - 22382
+allow 22407
+allow 22411
+allow 22431
+allow 22453
+allow 22501
+allow 22508
+allow 22515
+allow 22529
+allow 22541
+allow 22548
+allow 22566
+allow 22628
+allow 22661
+allow 22678
+allow 22689
+allow 22698 - 22699
+allow 22706
+allow 22724
+allow 22726
+allow 22745
+allow 22798
+allow 22818 - 22819
+allow 22833
+allow 22860
+allow 22869
+allow 22876
+allow 22882
+allow 22884
+allow 22889
+allow 22894
+allow 22908
+allow 22924
+allow 22927
+allow 22975
+allow 23002
+allow 23007
+allow 23020
+allow 23031
+allow 23074
+allow 23091
+allow 23105 - 23106
+allow 23113
+allow 23128
+allow 23140
+allow 23201 - 23202
+allow 23216
+allow 23243
+allow 23246
+allow 23289
+allow 23353
+allow 23360
+allow 23382 - 23383
+allow 23416
+allow 23487 - 23488
+allow 23495
+allow 23541
+allow 25607
+allow 25620
+allow 25701
+allow 25705
+allow 25718
+allow 25734
+allow 25812
+allow 25832
+allow 25908
+allow 25927
+allow 25933
+allow 25998
+allow 26048
+allow 26061
+allow 26090
+allow 26104 - 26105
+allow 26107
+allow 26112
+allow 26118 - 26119
+allow 26136
+allow 26162
+allow 26173
+allow 26194
+allow 26210
+allow 26218
+allow 26317
+allow 26418
+allow 26426
+allow 26434
+allow 26473
+allow 26505
+allow 26592 - 26623
+
+# AFRINIC Internet Number Resources cannot be transferred
+# From https://www.iana.org/assignments/ipv4-address-space/
+deny 41.0.0.0/8
+deny 102.0.0.0/8
+deny 105.0.0.0/8
+deny 154.0.0.0/16
+deny 154.16.0.0/16
+deny 154.65.0.0 - 154.255.255.255
+deny 196.0.0.0 - 196.1.0.255
+deny 196.1.4.0/24
+deny 196.1.7.0 - 196.1.63.255
+deny 196.1.71.0/24
+deny 196.1.74.0 - 196.1.103.255
+deny 196.1.115.0 - 196.1.133.255
+deny 196.1.137.0/24
+deny 196.1.143.0 - 196.1.159.255
+deny 196.1.176.0 - 196.1.255.255
+deny 196.2.2.0/23
+deny 196.2.8.0 - 196.2.255.255
+deny 196.3.14.0/23
+deny 196.3.57.0 - 196.3.64.255
+deny 196.3.90.0/24
+deny 196.3.92.0 - 196.3.94.255
+deny 196.3.96.0/21
+deny 196.3.105.0/24
+deny 196.3.107.0 - 196.3.131.255
+deny 196.3.148.0/22
+deny 196.3.154.0 - 196.3.183.255
+deny 196.3.224.0 - 196.4.45.255
+deny 196.4.71.0 - 196.11.171.255
+deny 196.11.174.0 - 196.11.239.255
+deny 196.11.248.0/21
+deny 196.12.10.0 - 196.12.31.255
+deny 196.12.128.0/19
+deny 196.12.192.0 - 196.15.15.255
+deny 196.15.64.0 - 196.26.255.255
+deny 196.27.64.0 - 196.28.47.255
+deny 196.28.64.0 - 196.29.63.255
+deny 196.29.96.0 - 196.31.255.255
+deny 196.32.8.0 - 196.32.31.255
+deny 196.32.96.0/19
+deny 196.32.160.0 - 196.39.255.255
+deny 196.40.96.0 - 196.41.255.255
+deny 196.42.64.0 - 196.216.0.255
+deny 196.216.2.0 - 197.255.255.255
+
+# Private use IPv4 & IPv6 addresses and ASNs
+deny 0.0.0.0/8               # RFC 1122 Local Identification
+deny 10.0.0.0/8              # RFC 1918 private space
+deny 100.64.0.0/10           # RFC 6598 Carrier Grade NAT
+deny 127.0.0.0/8             # RFC 1122 localhost
+deny 169.254.0.0/16          # RFC 3927 link local
+deny 172.16.0.0/12           # RFC 1918 private space
+deny 192.0.2.0/24            # RFC 5737 TEST-NET-1
+deny 192.88.99.0/24          # RFC 7526 6to4 anycast relay
+deny 192.168.0.0/16          # RFC 1918 private space
+deny 198.18.0.0/15           # RFC 2544 benchmarking
+deny 198.51.100.0/24         # RFC 5737 TEST-NET-2
+deny 203.0.113.0/24          # RFC 5737 TEST-NET-3
+deny 224.0.0.0/4             # Multicast
+deny 240.0.0.0/4             # Reserved
+
+# LACNIC supports only IPv4 transfers: allow the complement of what is denied
+allow 0.0.0.0/0
diff --git a/tals/lacnic.tal b/tals/lacnic.tal
new file mode 100644
index 0000000..c9b9e49
--- /dev/null
+++ b/tals/lacnic.tal
@@ -0,0 +1,10 @@
+https://rrdp.lacnic.net/ta/rta-lacnic-rpki.cer
+rsync://repository.lacnic.net/rpki/lacnic/rta-lacnic-rpki.cer
+
+MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqZEzhYK0+PtDOPfub/KR
+c3MeWx3neXx4/wbnJWGbNAtbYqXg3uU5J4HFzPgk/VIppgSKAhlO0H60DRP48by9
+gr5/yDHu2KXhOmnMg46sYsUIpfgtBS9+VtrqWziJfb+pkGtuOWeTnj6zBmBNZKK+
+5AlMCW1WPhrylIcB+XSZx8tk9GS/3SMQ+YfMVwwAyYjsex14Uzto4GjONALE5oh1
+M3+glRQduD6vzSwOD+WahMbc9vCOTED+2McLHRKgNaQf0YJ9a1jG9oJIvDkKXEqd
+fqDRktwyoD74cV57bW3tBAexB7GglITbInyQAsmdngtfg2LUMrcROHHP86QPZINj
+DQIDAQAB
diff --git a/tals/ripe.constraints b/tals/ripe.constraints
new file mode 100644
index 0000000..f921da9
--- /dev/null
+++ b/tals/ripe.constraints
@@ -0,0 +1,985 @@
+#	$OpenBSD: ripe.constraints,v 1.6 2026/07/09 12:29:52 job Exp $
+
+# From https://www.iana.org/assignments/ipv6-unicast-address-assignments
+allow 2001:600::/23
+allow 2001:800::/22
+allow 2001:1400::/22
+allow 2001:1a00::/23
+allow 2001:1c00::/22
+allow 2001:2000::/19
+allow 2001:4000::/23
+allow 2001:4600::/23
+allow 2001:4a00::/23
+allow 2001:4c00::/23
+allow 2001:5000::/20
+allow 2003::/18
+allow 2a00::/12
+allow 2a10::/12
+
+# LACNIC ASNs cannot be transferred to RIPE NCC
+# From https://www.iana.org/assignments/as-numbers/
+deny 27648 - 28671
+deny 52224 - 53247
+deny 61440 - 61951
+deny 64099 - 64197
+deny 262144 - 275868
+
+# LACNIC ASNs cannot be transferred to RIPE NCC
+# From nro-delegated-stats 20240417
+deny 278
+deny 676
+deny 1251
+deny 1292
+deny 1296
+deny 1797
+deny 1831
+deny 1840
+deny 1916
+deny 2146
+deny 2277
+deny 2549
+deny 2638
+deny 2708
+deny 2715 - 2716
+deny 2739
+deny 2904
+deny 3132
+deny 3141
+deny 3449
+deny 3454
+deny 3484
+deny 3487
+deny 3496
+deny 3548
+deny 3551
+deny 3556
+deny 3596 - 3597
+deny 3603
+deny 3631 - 3632
+deny 3636
+deny 3640
+deny 3790
+deny 3816
+deny 3905
+deny 3968
+deny 4141
+deny 4209
+deny 4230
+deny 4242
+deny 4244
+deny 4270
+deny 4387
+deny 4493
+deny 4535
+deny 4914
+deny 4926
+deny 4944
+deny 4964
+deny 4967
+deny 4995
+deny 5005
+deny 5633
+deny 5639
+deny 5648
+deny 5692
+deny 5708
+deny 5722
+deny 5745
+deny 5772
+deny 6057
+deny 6063 - 6065
+deny 6084
+deny 6121
+deny 6125
+deny 6133
+deny 6135
+deny 6147 - 6148
+deny 6193
+deny 6240
+deny 6306
+deny 6332
+deny 6342
+deny 6400
+deny 6429
+deny 6458
+deny 6471
+deny 6487
+deny 6495
+deny 6503
+deny 6505
+deny 6535
+deny 6543
+deny 6545
+deny 6568
+deny 6590
+deny 6927
+deny 6945
+deny 6957
+deny 7002
+deny 7004 - 7005
+deny 7038
+deny 7048 - 7049
+deny 7056
+deny 7063
+deny 7080
+deny 7087
+deny 7103
+deny 7120
+deny 7125
+deny 7137
+deny 7149
+deny 7157
+deny 7162
+deny 7167
+deny 7173
+deny 7184
+deny 7195
+deny 7199
+deny 7236
+deny 7298
+deny 7303
+deny 7313
+deny 7315
+deny 7325
+deny 7340
+deny 7365
+deny 7399
+deny 7408
+deny 7414
+deny 7417 - 7418
+deny 7428
+deny 7437 - 7438
+deny 7465
+deny 7727
+deny 7738
+deny 7803
+deny 7864
+deny 7890
+deny 7906
+deny 7908
+deny 7910
+deny 7927
+deny 7934
+deny 7953
+deny 7965
+deny 7974
+deny 7980
+deny 7984
+deny 7993 - 7995
+deny 7997
+deny 8007
+deny 8024
+deny 8026
+deny 8048
+deny 8053 - 8056
+deny 8065 - 8066
+deny 8096
+deny 8140 - 8141
+deny 8151
+deny 8163
+deny 8167
+deny 8178
+deny 10269
+deny 10277
+deny 10285
+deny 10293
+deny 10299
+deny 10301
+deny 10318
+deny 10362
+deny 10391
+deny 10412
+deny 10417
+deny 10420
+deny 10429
+deny 10436
+deny 10452
+deny 10454
+deny 10463
+deny 10476
+deny 10479
+deny 10481
+deny 10495
+deny 10502
+deny 10531
+deny 10560
+deny 10569
+deny 10586
+deny 10600
+deny 10605 - 10606
+deny 10617
+deny 10620
+deny 10624
+deny 10630
+deny 10640
+deny 10649
+deny 10670 - 10671
+deny 10688
+deny 10691
+deny 10697
+deny 10704
+deny 10706
+deny 10715
+deny 10733
+deny 10757
+deny 10778
+deny 10785
+deny 10795
+deny 10824
+deny 10834
+deny 10841
+deny 10847
+deny 10875
+deny 10881
+deny 10895
+deny 10897
+deny 10906
+deny 10938
+deny 10954
+deny 10964
+deny 10983
+deny 10986
+deny 10992
+deny 11008
+deny 11014
+deny 11053
+deny 11058
+deny 11063
+deny 11081
+deny 11083
+deny 11087
+deny 11097
+deny 11136
+deny 11172
+deny 11193
+deny 11237
+deny 11242
+deny 11254
+deny 11256
+deny 11271
+deny 11284
+deny 11295
+deny 11311
+deny 11315
+deny 11335
+deny 11338
+deny 11340
+deny 11356
+deny 11373
+deny 11390
+deny 11392
+deny 11411
+deny 11415
+deny 11419
+deny 11431 - 11432
+deny 11447
+deny 11450 - 11451
+deny 11497 - 11498
+deny 11503
+deny 11514
+deny 11519
+deny 11556
+deny 11562
+deny 11571
+deny 11581
+deny 11585
+deny 11592
+deny 11599
+deny 11617
+deny 11642
+deny 11644
+deny 11664
+deny 11673
+deny 11677
+deny 11694
+deny 11706
+deny 11750 - 11752
+deny 11786
+deny 11800 - 11802
+deny 11815 - 11816
+deny 11830
+deny 11835
+deny 11844
+deny 11888
+deny 11896
+deny 11921
+deny 11947
+deny 11960
+deny 11993
+deny 12034
+deny 12066
+deny 12127
+deny 12135 - 12136
+deny 12140
+deny 12146
+deny 12150
+deny 12248
+deny 12252
+deny 12264
+deny 13316
+deny 13318
+deny 13320
+deny 13353
+deny 13357
+deny 13381
+deny 13424
+deny 13440
+deny 13459
+deny 13474
+deny 13489
+deny 13495
+deny 13514
+deny 13521 - 13522
+deny 13544
+deny 13579
+deny 13584 - 13585
+deny 13591
+deny 13643
+deny 13679
+deny 13682
+deny 13761
+deny 13774
+deny 13835
+deny 13874
+deny 13878
+deny 13914
+deny 13929
+deny 13934 - 13936
+deny 13991
+deny 13999 - 14000
+deny 14026
+deny 14030
+deny 14069
+deny 14080
+deny 14084
+deny 14087
+deny 14111
+deny 14117
+deny 14122
+deny 14178 - 14179
+deny 14186 - 14187
+deny 14202
+deny 14204
+deny 14231 - 14232
+deny 14234
+deny 14249 - 14250
+deny 14259
+deny 14282
+deny 14285 - 14286
+deny 14316
+deny 14318
+deny 14339
+deny 14346
+deny 14377
+deny 14420
+deny 14457
+deny 14463
+deny 14522
+deny 14535
+deny 14553
+deny 14560
+deny 14571
+deny 14624
+deny 14650
+deny 14664
+deny 14674
+deny 14692
+deny 14708 - 14709
+deny 14723
+deny 14754
+deny 14759
+deny 14769
+deny 14795
+deny 14840
+deny 14845
+deny 14867 - 14868
+deny 14886
+deny 14966
+deny 14970
+deny 15030
+deny 15034
+deny 15064
+deny 15066
+deny 15075
+deny 15078
+deny 15107
+deny 15125
+deny 15151
+deny 15180
+deny 15201
+deny 15208
+deny 15236
+deny 15241
+deny 15246
+deny 15252
+deny 15256
+deny 15274
+deny 15311
+deny 16397
+deny 16418
+deny 16471
+deny 16506
+deny 16522
+deny 16528
+deny 16531
+deny 16592
+deny 16594
+deny 16596
+deny 16606 - 16607
+deny 16629
+deny 16663
+deny 16685
+deny 16689
+deny 16701
+deny 16712
+deny 16732
+deny 16735 - 16736
+deny 16742
+deny 16762
+deny 16772
+deny 16780
+deny 16814
+deny 16847
+deny 16849
+deny 16864
+deny 16874
+deny 16885
+deny 16891
+deny 16906
+deny 16911
+deny 16960
+deny 16973
+deny 16975
+deny 16990
+deny 17069
+deny 17072
+deny 17079
+deny 17086
+deny 17108
+deny 17126
+deny 17147
+deny 17182
+deny 17205
+deny 17208
+deny 17222
+deny 17249 - 17250
+deny 17255
+deny 17257
+deny 17287
+deny 17329
+deny 17376
+deny 17379
+deny 17399
+deny 17401
+deny 18449
+deny 18455
+deny 18466
+deny 18479
+deny 18492
+deny 18496
+deny 18532
+deny 18547
+deny 18576
+deny 18579
+deny 18592
+deny 18644
+deny 18667
+deny 18678
+deny 18734
+deny 18739
+deny 18782
+deny 18809
+deny 18822
+deny 18836
+deny 18840
+deny 18846
+deny 18869
+deny 18881
+deny 18941
+deny 18998
+deny 19033
+deny 19037 - 19038
+deny 19064
+deny 19077
+deny 19089 - 19090
+deny 19109
+deny 19114
+deny 19132
+deny 19169
+deny 19180
+deny 19182
+deny 19192
+deny 19196
+deny 19200
+deny 19228
+deny 19244
+deny 19259
+deny 19278
+deny 19315
+deny 19332
+deny 19338
+deny 19361
+deny 19373
+deny 19411
+deny 19422
+deny 19429
+deny 19447
+deny 19519
+deny 19553
+deny 19582 - 19583
+deny 19611
+deny 19632
+deny 19688
+deny 19723
+deny 19731
+deny 19763
+deny 19767
+deny 19863
+deny 19873
+deny 19889
+deny 19960
+deny 19978
+deny 19989 - 19990
+deny 20002
+deny 20015
+deny 20032
+deny 20043 - 20044
+deny 20106
+deny 20116 - 20117
+deny 20121
+deny 20142
+deny 20173
+deny 20191
+deny 20207
+deny 20232
+deny 20244
+deny 20255 - 20256
+deny 20266
+deny 20297
+deny 20299
+deny 20305
+deny 20312
+deny 20321
+deny 20345
+deny 20361
+deny 20363
+deny 20418
+deny 21506
+deny 21520
+deny 21571
+deny 21574 - 21575
+deny 21578
+deny 21590
+deny 21599
+deny 21603
+deny 21612
+deny 21614
+deny 21674
+deny 21692
+deny 21741
+deny 21753
+deny 21756
+deny 21765
+deny 21768
+deny 21824
+deny 21826
+deny 21838
+deny 21862
+deny 21883
+deny 21888
+deny 21911
+deny 21917
+deny 21980
+deny 22010 - 22011
+deny 22019
+deny 22047
+deny 22055
+deny 22080
+deny 22085
+deny 22092
+deny 22122
+deny 22128 - 22129
+deny 22133
+deny 22148
+deny 22177
+deny 22185
+deny 22227
+deny 22250
+deny 22305
+deny 22313
+deny 22341
+deny 22356
+deny 22368
+deny 22371
+deny 22381 - 22382
+deny 22407
+deny 22411
+deny 22431
+deny 22453
+deny 22501
+deny 22508
+deny 22515
+deny 22529
+deny 22541
+deny 22548
+deny 22566
+deny 22628
+deny 22661
+deny 22678
+deny 22689
+deny 22698 - 22699
+deny 22706
+deny 22724
+deny 22726
+deny 22745
+deny 22798
+deny 22818 - 22819
+deny 22833
+deny 22860
+deny 22869
+deny 22876
+deny 22882
+deny 22884
+deny 22889
+deny 22894
+deny 22908
+deny 22924
+deny 22927
+deny 22975
+deny 23002
+deny 23007
+deny 23020
+deny 23031
+deny 23074
+deny 23091
+deny 23105 - 23106
+deny 23113
+deny 23128
+deny 23140
+deny 23201 - 23202
+deny 23216
+deny 23243
+deny 23246
+deny 23289
+deny 23353
+deny 23360
+deny 23382 - 23383
+deny 23416
+deny 23487 - 23488
+deny 23495
+deny 23541
+deny 25607
+deny 25620
+deny 25701
+deny 25705
+deny 25718
+deny 25734
+deny 25812
+deny 25832
+deny 25908
+deny 25927
+deny 25933
+deny 25998
+deny 26048
+deny 26061
+deny 26090
+deny 26104 - 26105
+deny 26107
+deny 26112
+deny 26118 - 26119
+deny 26136
+deny 26162
+deny 26173
+deny 26194
+deny 26210
+deny 26218
+deny 26317
+deny 26418
+deny 26426
+deny 26434
+deny 26473
+deny 26505
+deny 26592 - 26623
+
+# AFRINIC IPv4 resources cannot be transferred to RIPE NCC
+# From https://www.iana.org/assignments/ipv4-address-space/
+deny 41.0.0.0/8
+deny 102.0.0.0/8
+deny 105.0.0.0/8
+deny 154.0.0.0/16
+deny 154.16.0.0/16
+deny 154.65.0.0 - 154.255.255.255
+deny 196.0.0.0 - 196.1.0.255
+deny 196.1.4.0/24
+deny 196.1.7.0 - 196.1.63.255
+deny 196.1.71.0/24
+deny 196.1.74.0 - 196.1.103.255
+deny 196.1.115.0 - 196.1.133.255
+deny 196.1.137.0/24
+deny 196.1.143.0 - 196.1.159.255
+deny 196.1.176.0 - 196.1.255.255
+deny 196.2.2.0/23
+deny 196.2.8.0 - 196.2.255.255
+deny 196.3.14.0/23
+deny 196.3.57.0 - 196.3.64.255
+deny 196.3.90.0/24
+deny 196.3.92.0 - 196.3.94.255
+deny 196.3.96.0/21
+deny 196.3.105.0/24
+deny 196.3.107.0 - 196.3.131.255
+deny 196.3.148.0/22
+deny 196.3.154.0 - 196.3.183.255
+deny 196.3.224.0 - 196.4.45.255
+deny 196.4.71.0 - 196.11.171.255
+deny 196.11.174.0 - 196.11.239.255
+deny 196.11.248.0/21
+deny 196.12.10.0 - 196.12.31.255
+deny 196.12.128.0/19
+deny 196.12.192.0 - 196.15.15.255
+deny 196.15.64.0 - 196.26.255.255
+deny 196.27.64.0 - 196.28.47.255
+deny 196.28.64.0 - 196.29.63.255
+deny 196.29.96.0 - 196.31.255.255
+deny 196.32.8.0 - 196.32.31.255
+deny 196.32.96.0/19
+deny 196.32.160.0 - 196.39.255.255
+deny 196.40.96.0 - 196.41.255.255
+deny 196.42.64.0 - 196.216.0.255
+deny 196.216.2.0 - 197.255.255.255
+
+# AFRINIC ASNs cannot be transferred to RIPE NCC
+# From https://www.iana.org/assignments/as-numbers/
+deny 36864 - 37887
+deny 327680 - 330751
+
+# AFRINIC ASNs cannot be transferred to RIPE NCC
+# From nro-delegated-stats 20240417
+deny 1228 - 1232
+deny 2018
+deny 2561
+deny 2905
+deny 3067 - 3068
+deny 3208
+deny 3741
+deny 4178
+deny 4571
+deny 5536
+deny 5713
+deny 5734
+deny 6083
+deny 6089
+deny 6127
+deny 6149
+deny 6180
+deny 6187
+deny 6351
+deny 6529
+deny 6560
+deny 6713
+deny 6879
+deny 6968
+deny 7020
+deny 7154
+deny 7231
+deny 7390
+deny 7420
+deny 7460
+deny 7971 - 7972
+deny 8094
+deny 8524
+deny 8770
+deny 9129
+deny 10247
+deny 10262
+deny 10331
+deny 10393
+deny 10474
+deny 10505
+deny 10540
+deny 10575
+deny 10798
+deny 10803
+deny 10898
+deny 11125
+deny 11157
+deny 11201
+deny 11259
+deny 11265
+deny 11380
+deny 11569
+deny 11645
+deny 11744
+deny 11845
+deny 11909
+deny 12091
+deny 12143
+deny 12258
+deny 12455
+deny 12556
+deny 13224
+deny 13402
+deny 13519
+deny 13569
+deny 13854
+deny 14029
+deny 14115
+deny 14331
+deny 14429
+deny 14516
+deny 14988
+deny 15022
+deny 15159
+deny 15399
+deny 15475
+deny 15706
+deny 15804
+deny 15825
+deny 15834
+deny 15964
+deny 16058
+deny 16214
+deny 16284
+deny 16416
+deny 16547
+deny 16630
+deny 16637
+deny 16800
+deny 16853
+deny 16907
+deny 17148
+deny 17220
+deny 17260
+deny 17312
+deny 17400
+deny 17652
+deny 18775
+deny 18922
+deny 18931
+deny 19136
+deny 19232
+deny 19676
+deny 19711
+deny 19832
+deny 19847
+deny 20011
+deny 20086
+deny 20095
+deny 20180
+deny 20294
+deny 20459
+deny 20484
+deny 20858
+deny 20928
+deny 21003
+deny 21152
+deny 21242
+deny 21271
+deny 21278
+deny 21280
+deny 21391
+deny 21452
+deny 21739
+deny 21819
+deny 22354 - 22355
+deny 22386
+deny 22572
+deny 22690
+deny 22735
+deny 22750
+deny 22939
+deny 23058
+deny 23549
+deny 23889
+deny 24736
+deny 24757
+deny 24788
+deny 24801
+deny 24835
+deny 24863
+deny 24878
+deny 24987
+deny 25163
+deny 25250
+deny 25362
+deny 25364
+deny 25543
+deny 25568
+deny 25576
+deny 25695
+deny 25726
+deny 25793
+deny 25818
+deny 26106
+deny 26130
+deny 26422
+deny 26625
+deny 26754
+deny 27576
+deny 27598
+deny 28683
+deny 28698
+deny 28913
+deny 29091
+deny 29338
+deny 29340
+deny 29428
+deny 29495
+deny 29544
+deny 29571
+deny 29614
+deny 29674
+deny 29918
+deny 29975
+deny 30073
+deny 30306
+deny 30429
+deny 30619
+deny 30896
+deny 30980
+deny 30982 - 30999
+deny 31065
+deny 31245
+deny 31619
+deny 31810
+deny 31856
+deny 31960
+deny 32017
+deny 32279
+deny 32398
+deny 32437
+deny 32653
+deny 32714
+deny 32717
+deny 32842
+deny 32860
+deny 33567
+deny 33579
+deny 33762 - 33791
+
+# Private use IPv4 & IPv6 addresses and ASNs
+deny 0.0.0.0/8               # RFC 1122 Local Identification
+deny 10.0.0.0/8              # RFC 1918 private space
+deny 100.64.0.0/10           # RFC 6598 Carrier Grade NAT
+deny 127.0.0.0/8             # RFC 1122 localhost
+deny 169.254.0.0/16          # RFC 3927 link local
+deny 172.16.0.0/12           # RFC 1918 private space
+deny 192.0.2.0/24            # RFC 5737 TEST-NET-1
+deny 192.88.99.0/24          # RFC 7526 6to4 anycast relay
+deny 192.168.0.0/16          # RFC 1918 private space
+deny 198.18.0.0/15           # RFC 2544 benchmarking
+deny 198.51.100.0/24         # RFC 5737 TEST-NET-2
+deny 203.0.113.0/24          # RFC 5737 TEST-NET-3
+deny 224.0.0.0/4             # Multicast
+deny 240.0.0.0/4             # Reserved
+deny 23456                   # RFC 4893 AS_TRANS
+deny 64496 - 64511           # RFC 5398
+deny 64512 - 65534           # RFC 6996
+deny 65535                   # RFC 7300
+deny 65536 - 65551           # RFC 5398
+deny 65552 - 131071          # IANA Reserved
+deny 4200000000 - 4294967294 # RFC 6996
+deny 4294967295              # RFC 7300
+
+# RIPE NCC supports IPv4 and ASN transfers: allow the complement of what is denied
+allow 0.0.0.0/0
+allow 1 - 4199999999
diff --git a/tals/ripe.tal b/tals/ripe.tal
new file mode 100644
index 0000000..80002d9
--- /dev/null
+++ b/tals/ripe.tal
@@ -0,0 +1,10 @@
+https://rpki.ripe.net/ta/ripe-ncc-ta.cer
+rsync://rpki.ripe.net/ta/ripe-ncc-ta.cer
+
+MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0URYSGqUz2myBsOzeW1j
+Q6NsxNvlLMyhWknvnl8NiBCs/T/S2XuNKQNZ+wBZxIgPPV2pFBFeQAvoH/WK83Hw
+A26V2siwm/MY2nKZ+Olw+wlpzlZ1p3Ipj2eNcKrmit8BwBC8xImzuCGaV0jkRB0G
+Z0hoH6Ml03umLprRsn6v0xOP0+l6Qc1ZHMFVFb385IQ7FQQTcVIxrdeMsoyJq9eM
+kE6DoclHhF/NlSllXubASQ9KUWqJ0+Ot3QCXr4LXECMfkpkVR2TZT+v5v658bHVs
+6ZxRD1b6Uk1uQKAyHUbn/tXvP8lrjAibGzVsXDT2L0x4Edx+QdixPgOji3gBMyL2
+VwIDAQAB
diff --git a/tests/cli_errors.rs b/tests/cli_errors.rs
index 679b750..06d01a6 100644
--- a/tests/cli_errors.rs
+++ b/tests/cli_errors.rs
@@ -91,3 +91,50 @@ fn config_mode_and_mutually_exclusive_inspection_flags_are_rejected() {
     assert_eq!(result.status.code(), Some(2));
     assert!(String::from_utf8_lossy(&result.stderr).contains("mutually exclusive"));
 }
+
+#[test]
+fn all5_examples_load_vendored_constraints_and_disable_ignores_missing_files() {
+    let directory = tempfile::tempdir().unwrap();
+    let repo = std::path::Path::new(env!("CARGO_MANIFEST_DIR"));
+    for (mode, example) in [
+        ("validate", "validate-all5.toml"),
+        ("daemon", "daemon-all5.toml"),
+    ] {
+        let raw = std::fs::read_to_string(repo.join("docker/examples").join(example))
+            .unwrap()
+            .replace("/input", repo.join("tals").to_str().unwrap())
+            .replace("/output", directory.path().join("out").to_str().unwrap())
+            .replace("/state", directory.path().join("state").to_str().unwrap())
+            .replace("/data", directory.path().join("data").to_str().unwrap());
+        let config = directory.path().join(example);
+        for (enabled, missing, expected) in [(true, false, 0), (true, true, 2), (false, true, 0)] {
+            let mut text = raw.replace(
+                "ta-constraints-enabled = true",
+                &format!("ta-constraints-enabled = {enabled}"),
+            );
+            if missing {
+                text = text.replace(".constraints\"", ".missing\"");
+            }
+            std::fs::write(&config, text).unwrap();
+            for inspect in ["--check-config", "--print-config"] {
+                let result = command()
+                    .args([mode, "--config", config.to_str().unwrap(), inspect])
+                    .output()
+                    .unwrap();
+                assert_eq!(
+                    result.status.code(),
+                    Some(expected),
+                    "{}",
+                    String::from_utf8_lossy(&result.stderr)
+                );
+                if inspect == "--print-config" && expected == 0 {
+                    let printed: serde_json::Value =
+                        serde_json::from_slice(&result.stdout).unwrap();
+                    assert_eq!(printed["effective"]["ta-constraints-enabled"], enabled);
+                }
+            }
+        }
+        assert!(!directory.path().join("out").exists());
+        assert!(!directory.path().join("data").exists());
+    }
+}
diff --git a/tests/synthetic_docker_e2e.sh b/tests/synthetic_docker_e2e.sh
index 057f4ef..414d2ff 100755
--- a/tests/synthetic_docker_e2e.sh
+++ b/tests/synthetic_docker_e2e.sh
@@ -47,6 +47,8 @@ fi
 run_validator() {
     local out="$1"
     local mode="$2"
+    local enabled="${3:-true}"
+    local policy="${4:-}"
     local config="$work_root/validate-$mode.toml"
     cat >"$config" <<EOF
 config-version = 1
@@ -54,6 +56,7 @@ mode = "validate"
 out = "/output"
 rrdp-state-dir = "/state"
 rrdp-sync-mode = "$mode"
+ta-constraints-enabled = $enabled
 ccr-out = "/output/result.ccr"
 http-timeout-secs = 5
 http-root-cert = ["/fixture/certs/rrdp-ca.pem"]
@@ -66,6 +69,7 @@ log-format = "json"
 id = "custom"
 tal = "/fixture/tal/custom.tal"
 ta = "/fixture/ta/custom-ta.cer"
+$policy
 EOF
     docker run --rm --network host --user "$(id -u):$(id -g)" \
         -v "$fixture:/fixture:ro" \
@@ -103,6 +107,29 @@ timing = json.loads((delta / "stage-timing.json").read_text(encoding="utf-8"))
 assert timing["analysis_counts"]["rrdp_delta_ops_applied_total"] > 0, timing
 PY
 
+# Policy changes must affect payloads even when RRDP is a noop.
+printf 'deny 0.0.0.0/0\ndeny ::/0\ndeny 0 - 4294967295\n' >"$fixture/tal/custom.constraints"
+mkdir -p "$work_root/output-denied" "$work_root/output-custom" "$work_root/output-disabled"
+run_validator "$work_root/output-denied" delta true
+printf 'allow 0.0.0.0/0\nallow ::/0\nallow 0 - 4294967295\n' >"$fixture/tal/allow.constraints"
+run_validator "$work_root/output-custom" delta true 'constraints = "/fixture/tal/allow.constraints"'
+printf 'malformed policy\n' >"$fixture/tal/custom.constraints"
+run_validator "$work_root/output-disabled" delta false 'constraints = "/fixture/tal/missing.constraints"'
+python3 - "$work_root" <<'PYTEST'
+import json, pathlib, sys
+root = pathlib.Path(sys.argv[1])
+for name, expected, enabled in [("denied", 0, True), ("custom", 2, True), ("disabled", 2, False)]:
+    out = root / f"output-{name}"
+    summary = json.loads((out / "summary.json").read_text())
+    assert summary["vrps"] == expected, summary
+    assert summary["taConstraintsEnabled"] == enabled, summary
+    assert len(summary["taConstraintsApplied"]) == int(enabled), summary
+    assert len((out / "vaps.csv").read_text().splitlines()) - 1 == (0 if name == "denied" else 1)
+    assert (out / "result-complete.json").exists()
+print("Constraints deny/custom/disabled payload checks passed with reused RRDP state")
+PYTEST
+rm "$fixture/tal/custom.constraints"
+
 echo "Synthetic Docker snapshot+delta E2E passed"
 
 # Exercise the actual public daemon in the image with a fresh protocol root.