{"$schema":"https://json-schema.org/draft/2020-12/schema","additionalProperties":false,"properties":{"actor":{"additionalProperties":false,"properties":{"identityAssurance":{"enum":["SELF_ATTESTED","EXTERNAL_REFERENCE","AGENT_DECLARED","SYSTEM_ASSERTED"],"type":"string"},"label":{"maxLength":240,"minLength":1,"type":"string"},"type":{"enum":["AGENT","SYSTEM","HUMAN"],"type":"string"}},"required":["type","label","identityAssurance"],"type":"object"},"authorityActuallyExercised":{"enum":["NONE","ANALYSIS_ONLY","RECOMMENDATION","GOVERNED_PROPOSAL","HUMAN_APPROVED_ACTION","POLICY_BOUND_ACTION"],"type":"string"},"boundaryStatement":{"const":"Implementation and passing tests do not by themselves prove external deployment, external effect, operational safety, accountable acceptance, or business outcome.","type":"string"},"changedArtifacts":{"items":{"additionalProperties":false,"properties":{"changeKind":{"enum":["ADDED","MODIFIED","DELETED","GENERATED"],"type":"string"},"path":{"maxLength":240,"minLength":1,"type":"string"},"sha256":{"anyOf":[{"pattern":"^[a-f0-9]{64}$","type":"string"},{"type":"null"}]}},"required":["path","sha256","changeKind"],"type":"object"},"maxItems":300,"type":"array"},"deploymentReferences":{"items":{"maxLength":240,"minLength":1,"type":"string"},"maxItems":50,"type":"array"},"evidence":{"items":{"additionalProperties":false,"properties":{"actorLabel":{"maxLength":240,"minLength":1,"type":"string"},"actorType":{"enum":["AGENT","SYSTEM","HUMAN"],"type":"string"},"confidentiality":{"enum":["PUBLIC","INTERNAL_REFERENCE","CONFIDENTIAL_REFERENCE","RESTRICTED_REFERENCE"],"type":"string"},"contentSha256":{"anyOf":[{"pattern":"^[a-f0-9]{64}$","type":"string"},{"type":"null"}]},"description":{"maxLength":1200,"minLength":1,"type":"string"},"fileIdentity":{"anyOf":[{"additionalProperties":false,"properties":{"byteLength":{"maximum":104857600,"minimum":0,"type":"integer"},"bytesDiscardedAfterHashing":{"const":true,"type":"boolean"},"filename":{"maxLength":240,"minLength":1,"type":"string"},"mediaType":{"maxLength":240,"minLength":1,"type":"string"},"sha256":{"pattern":"^[a-f0-9]{64}$","type":"string"}},"required":["filename","mediaType","byteLength","sha256","bytesDiscardedAfterHashing"],"type":"object"},{"type":"null"}]},"id":{"pattern":"^[a-z][a-z0-9-]{1,99}$","type":"string"},"locator":{"additionalProperties":false,"properties":{"externalId":{"anyOf":[{"maxLength":300,"type":"string"},{"type":"null"}]},"kind":{"enum":["LOCAL_FILE_IDENTITY","URL","REPOSITORY","PROVIDER","DOCUMENT","ATTESTATION","OTHER"],"type":"string"},"provider":{"anyOf":[{"maxLength":120,"type":"string"},{"type":"null"}]},"repository":{"anyOf":[{"maxLength":300,"type":"string"},{"type":"null"}]},"revision":{"anyOf":[{"maxLength":240,"type":"string"},{"type":"null"}]},"uri":{"anyOf":[{"format":"uri","maxLength":2000,"type":"string"},{"type":"null"}]}},"required":["kind","uri","repository","revision","provider","externalId"],"type":"object"},"recordedAt":{"format":"date-time","pattern":"^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z|([+-](?:[01]\\d|2[0-3]):[0-5]\\d)))$","type":"string"},"sourceState":{"enum":["OBSERVED","SELF_ATTESTED","EXTERNAL_REFERENCE","AGENT_REPORTED"],"type":"string"},"title":{"maxLength":240,"minLength":1,"type":"string"},"type":{"enum":["FILE_HASH","URL_REFERENCE","REPOSITORY_COMMIT","CI_RUN","TEST_RECEIPT","DEPLOYMENT_RECEIPT","PROVIDER_RECEIPT","SETTLEMENT_RECEIPT","DOCUMENT_REFERENCE","HUMAN_ATTESTATION","AGENT_ATTESTATION","OTHER_REFERENCE"],"type":"string"}},"required":["id","type","title","description","recordedAt","actorType","actorLabel","locator","fileIdentity","contentSha256","sourceState","confidentiality"],"type":"object"},"maxItems":300,"minItems":1,"type":"array"},"gateObservations":{"items":{"additionalProperties":false,"properties":{"evidenceIds":{"items":{"pattern":"^[a-z][a-z0-9-]{1,99}$","type":"string"},"maxItems":50,"minItems":1,"type":"array"},"gateId":{"pattern":"^[a-z][a-z0-9-]{1,99}$","type":"string"},"observedResult":{"enum":["PASS","FAIL","INCONCLUSIVE"],"type":"string"},"summary":{"maxLength":1200,"minLength":1,"type":"string"}},"required":["gateId","observedResult","evidenceIds","summary"],"type":"object"},"maxItems":100,"minItems":1,"type":"array"},"implementationCommits":{"items":{"maxLength":240,"minLength":1,"type":"string"},"maxItems":50,"minItems":1,"type":"array"},"issuedAt":{"format":"date-time","pattern":"^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z|([+-](?:[01]\\d|2[0-3]):[0-5]\\d)))$","type":"string"},"knownFailures":{"items":{"maxLength":1200,"minLength":1,"type":"string"},"maxItems":100,"type":"array"},"project":{"additionalProperties":false,"properties":{"projectIdentity":{"maxLength":240,"minLength":1,"type":"string"},"repository":{"maxLength":240,"minLength":1,"type":"string"}},"required":["repository","projectIdentity"],"type":"object"},"providerReceiptReferences":{"items":{"maxLength":240,"minLength":1,"type":"string"},"maxItems":50,"type":"array"},"receiptId":{"pattern":"^[a-z][a-z0-9-]{1,99}$","type":"string"},"schemaVersion":{"const":"decision-assurance-implementation-evidence-receipt-v1","type":"string"},"sourceAssuranceCase":{"anyOf":[{"additionalProperties":false,"properties":{"assuranceSha256":{"pattern":"^[a-f0-9]{64}$","type":"string"},"caseId":{"pattern":"^[a-z][a-z0-9-]{1,99}$","type":"string"},"caseVersion":{"exclusiveMinimum":0,"maximum":9007199254740991,"type":"integer"}},"required":["caseId","caseVersion","assuranceSha256"],"type":"object"},{"type":"null"}]},"sourcePack":{"additionalProperties":false,"properties":{"artifactVersion":{"anyOf":[{"const":1,"type":"number"},{"const":2,"type":"number"}]},"bundleSha256":{"pattern":"^[a-f0-9]{64}$","type":"string"},"productId":{"const":"decision_agent_implementation_pack","type":"string"},"sourceDesignSha256":{"pattern":"^[a-f0-9]{64}$","type":"string"}},"required":["productId","artifactVersion","bundleSha256","sourceDesignSha256"],"type":"object"},"unresolvedItems":{"items":{"maxLength":1200,"minLength":1,"type":"string"},"maxItems":100,"type":"array"}},"required":["schemaVersion","receiptId","issuedAt","actor","sourcePack","sourceAssuranceCase","project","implementationCommits","changedArtifacts","gateObservations","evidence","deploymentReferences","providerReceiptReferences","knownFailures","unresolvedItems","authorityActuallyExercised","boundaryStatement"],"type":"object"}