@behavproof/cli 0.0.0-stage → 0.1.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (67) hide show
  1. package/README.md +14 -2
  2. package/dist/api.d.ts +6 -0
  3. package/dist/api.d.ts.map +1 -0
  4. package/dist/api.js +5 -0
  5. package/dist/api.js.map +1 -0
  6. package/dist/check.d.ts +272 -0
  7. package/dist/check.d.ts.map +1 -0
  8. package/dist/check.js +220 -0
  9. package/dist/check.js.map +1 -0
  10. package/dist/formal-evaluation.d.ts +108 -0
  11. package/dist/formal-evaluation.d.ts.map +1 -0
  12. package/dist/formal-evaluation.js +78 -0
  13. package/dist/formal-evaluation.js.map +1 -0
  14. package/dist/formal-worker.d.ts +2 -0
  15. package/dist/formal-worker.d.ts.map +1 -0
  16. package/dist/formal-worker.js +32 -0
  17. package/dist/formal-worker.js.map +1 -0
  18. package/dist/formal.d.ts +148 -0
  19. package/dist/formal.d.ts.map +1 -0
  20. package/dist/formal.js +99 -0
  21. package/dist/formal.js.map +1 -0
  22. package/dist/impact.d.ts +20 -0
  23. package/dist/impact.d.ts.map +1 -0
  24. package/dist/impact.js +23 -0
  25. package/dist/impact.js.map +1 -0
  26. package/dist/index.d.ts +3 -0
  27. package/dist/index.d.ts.map +1 -0
  28. package/dist/index.js +151 -0
  29. package/dist/index.js.map +1 -0
  30. package/dist/pipeline.d.ts +38 -0
  31. package/dist/pipeline.d.ts.map +1 -0
  32. package/dist/pipeline.js +46 -0
  33. package/dist/pipeline.js.map +1 -0
  34. package/dist/project.d.ts +97 -0
  35. package/dist/project.d.ts.map +1 -0
  36. package/dist/project.js +101 -0
  37. package/dist/project.js.map +1 -0
  38. package/dist/registration.d.ts +595 -0
  39. package/dist/registration.d.ts.map +1 -0
  40. package/dist/registration.js +112 -0
  41. package/dist/registration.js.map +1 -0
  42. package/dist/report.d.ts +23 -0
  43. package/dist/report.d.ts.map +1 -0
  44. package/dist/report.js +34 -0
  45. package/dist/report.js.map +1 -0
  46. package/dist/scopes.d.ts +48 -0
  47. package/dist/scopes.d.ts.map +1 -0
  48. package/dist/scopes.js +60 -0
  49. package/dist/scopes.js.map +1 -0
  50. package/dist/trust.d.ts +533 -0
  51. package/dist/trust.d.ts.map +1 -0
  52. package/dist/trust.js +130 -0
  53. package/dist/trust.js.map +1 -0
  54. package/package.json +51 -4
  55. package/presets/basic-v1.json +21 -0
  56. package/presets/critical-v1.json +39 -0
  57. package/presets/standard-v1.json +21 -0
  58. package/schemas/config.schema.json +492 -0
  59. package/schemas/evidence.schema.json +3612 -0
  60. package/schemas/manifest.schema.json +225 -0
  61. package/schemas/policy.schema.json +21 -0
  62. package/schemas/registration.schema.json +1065 -0
  63. package/schemas/registry.schema.json +307 -0
  64. package/schemas/trust-root.schema.json +1445 -0
  65. package/templates/audit.yml +28 -0
  66. package/templates/protected-github-producer.yml +58 -0
  67. package/templates/protected-github-publisher.yml +111 -0
package/schemas/evidence.schema.json ADDED
@@ -0,0 +1,3612 @@
1
+ {
2
+ "$schema": "https://json-schema.org/draft/2020-12/schema",
3
+ "oneOf": [
4
+ {
5
+ "type": "object",
6
+ "properties": {
7
+ "schemaVersion": {
8
+ "type": "number",
9
+ "const": 1
10
+ },
11
+ "id": {
12
+ "type": "string",
13
+ "minLength": 1
14
+ },
15
+ "source": {
16
+ "type": "object",
17
+ "properties": {
18
+ "tool": {
19
+ "type": "string",
20
+ "minLength": 1
21
+ },
22
+ "version": {
23
+ "type": "string",
24
+ "minLength": 1
25
+ },
26
+ "artifactRef": {
27
+ "type": "string",
28
+ "minLength": 1
29
+ }
30
+ },
31
+ "required": [
32
+ "tool",
33
+ "artifactRef"
34
+ ],
35
+ "additionalProperties": false
36
+ },
37
+ "context": {
38
+ "type": "object",
39
+ "properties": {
40
+ "subject": {
41
+ "type": "object",
42
+ "properties": {
43
+ "repositoryId": {
44
+ "type": "string",
45
+ "minLength": 1
46
+ },
47
+ "prHeadSha": {
48
+ "type": "string",
49
+ "minLength": 1
50
+ },
51
+ "testedCommitSha": {
52
+ "type": "string",
53
+ "minLength": 1
54
+ },
55
+ "testedCommitParents": {
56
+ "type": "array",
57
+ "items": {
58
+ "type": "string",
59
+ "minLength": 1
60
+ }
61
+ },
62
+ "sourceTreeHash": {
63
+ "type": "string",
64
+ "pattern": "^[a-f0-9]{64}$"
65
+ },
66
+ "dirty": {
67
+ "type": "boolean"
68
+ },
69
+ "baseSha": {
70
+ "type": "string",
71
+ "minLength": 1
72
+ },
73
+ "diffBaseSha": {
74
+ "type": "string",
75
+ "minLength": 1
76
+ }
77
+ },
78
+ "required": [
79
+ "testedCommitSha",
80
+ "sourceTreeHash",
81
+ "dirty"
82
+ ],
83
+ "additionalProperties": false
84
+ },
85
+ "manifestRef": {
86
+ "type": "string",
87
+ "minLength": 1
88
+ },
89
+ "protectedPolicySha": {
90
+ "type": "string",
91
+ "minLength": 1
92
+ },
93
+ "effectivePolicyHash": {
94
+ "type": "string",
95
+ "pattern": "^[a-f0-9]{64}$"
96
+ },
97
+ "contractHash": {
98
+ "type": "string",
99
+ "pattern": "^[a-f0-9]{64}$"
100
+ },
101
+ "generatedAt": {
102
+ "type": "string",
103
+ "format": "date-time",
104
+ "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$"
105
+ },
106
+ "collectedAt": {
107
+ "type": "string",
108
+ "format": "date-time",
109
+ "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$"
110
+ }
111
+ },
112
+ "required": [
113
+ "effectivePolicyHash",
114
+ "collectedAt"
115
+ ],
116
+ "additionalProperties": false
117
+ },
118
+ "provenance": {
119
+ "type": "object",
120
+ "properties": {
121
+ "artifactIntegrity": {
122
+ "type": "string",
123
+ "enum": [
124
+ "pass",
125
+ "fail",
126
+ "unknown",
127
+ "not_applicable"
128
+ ]
129
+ },
130
+ "producerTrust": {
131
+ "type": "string",
132
+ "enum": [
133
+ "pass",
134
+ "fail",
135
+ "unknown",
136
+ "not_applicable"
137
+ ]
138
+ },
139
+ "subjectMatch": {
140
+ "type": "string",
141
+ "enum": [
142
+ "pass",
143
+ "fail",
144
+ "unknown",
145
+ "not_applicable"
146
+ ]
147
+ },
148
+ "reasons": {
149
+ "type": "array",
150
+ "items": {
151
+ "type": "string",
152
+ "minLength": 1
153
+ }
154
+ }
155
+ },
156
+ "required": [
157
+ "artifactIntegrity",
158
+ "producerTrust",
159
+ "subjectMatch",
160
+ "reasons"
161
+ ],
162
+ "additionalProperties": false
163
+ },
164
+ "subjectRefs": {
165
+ "type": "array",
166
+ "items": {
167
+ "type": "string",
168
+ "minLength": 1
169
+ }
170
+ },
171
+ "kind": {
172
+ "type": "string",
173
+ "const": "test"
174
+ },
175
+ "payload": {
176
+ "type": "object",
177
+ "properties": {
178
+ "total": {
179
+ "type": "integer",
180
+ "minimum": 0,
181
+ "maximum": 9007199254740991
182
+ },
183
+ "passed": {
184
+ "type": "integer",
185
+ "minimum": 0,
186
+ "maximum": 9007199254740991
187
+ },
188
+ "failed": {
189
+ "type": "integer",
190
+ "minimum": 0,
191
+ "maximum": 9007199254740991
192
+ },
193
+ "skipped": {
194
+ "type": "integer",
195
+ "minimum": 0,
196
+ "maximum": 9007199254740991
197
+ }
198
+ },
199
+ "required": [
200
+ "total",
201
+ "passed",
202
+ "failed",
203
+ "skipped"
204
+ ],
205
+ "additionalProperties": false
206
+ }
207
+ },
208
+ "required": [
209
+ "schemaVersion",
210
+ "id",
211
+ "source",
212
+ "context",
213
+ "provenance",
214
+ "subjectRefs",
215
+ "kind",
216
+ "payload"
217
+ ],
218
+ "additionalProperties": false
219
+ },
220
+ {
221
+ "type": "object",
222
+ "properties": {
223
+ "schemaVersion": {
224
+ "type": "number",
225
+ "const": 1
226
+ },
227
+ "id": {
228
+ "type": "string",
229
+ "minLength": 1
230
+ },
231
+ "source": {
232
+ "type": "object",
233
+ "properties": {
234
+ "tool": {
235
+ "type": "string",
236
+ "minLength": 1
237
+ },
238
+ "version": {
239
+ "type": "string",
240
+ "minLength": 1
241
+ },
242
+ "artifactRef": {
243
+ "type": "string",
244
+ "minLength": 1
245
+ }
246
+ },
247
+ "required": [
248
+ "tool",
249
+ "artifactRef"
250
+ ],
251
+ "additionalProperties": false
252
+ },
253
+ "context": {
254
+ "type": "object",
255
+ "properties": {
256
+ "subject": {
257
+ "type": "object",
258
+ "properties": {
259
+ "repositoryId": {
260
+ "type": "string",
261
+ "minLength": 1
262
+ },
263
+ "prHeadSha": {
264
+ "type": "string",
265
+ "minLength": 1
266
+ },
267
+ "testedCommitSha": {
268
+ "type": "string",
269
+ "minLength": 1
270
+ },
271
+ "testedCommitParents": {
272
+ "type": "array",
273
+ "items": {
274
+ "type": "string",
275
+ "minLength": 1
276
+ }
277
+ },
278
+ "sourceTreeHash": {
279
+ "type": "string",
280
+ "pattern": "^[a-f0-9]{64}$"
281
+ },
282
+ "dirty": {
283
+ "type": "boolean"
284
+ },
285
+ "baseSha": {
286
+ "type": "string",
287
+ "minLength": 1
288
+ },
289
+ "diffBaseSha": {
290
+ "type": "string",
291
+ "minLength": 1
292
+ }
293
+ },
294
+ "required": [
295
+ "testedCommitSha",
296
+ "sourceTreeHash",
297
+ "dirty"
298
+ ],
299
+ "additionalProperties": false
300
+ },
301
+ "manifestRef": {
302
+ "type": "string",
303
+ "minLength": 1
304
+ },
305
+ "protectedPolicySha": {
306
+ "type": "string",
307
+ "minLength": 1
308
+ },
309
+ "effectivePolicyHash": {
310
+ "type": "string",
311
+ "pattern": "^[a-f0-9]{64}$"
312
+ },
313
+ "contractHash": {
314
+ "type": "string",
315
+ "pattern": "^[a-f0-9]{64}$"
316
+ },
317
+ "generatedAt": {
318
+ "type": "string",
319
+ "format": "date-time",
320
+ "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$"
321
+ },
322
+ "collectedAt": {
323
+ "type": "string",
324
+ "format": "date-time",
325
+ "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$"
326
+ }
327
+ },
328
+ "required": [
329
+ "effectivePolicyHash",
330
+ "collectedAt"
331
+ ],
332
+ "additionalProperties": false
333
+ },
334
+ "provenance": {
335
+ "type": "object",
336
+ "properties": {
337
+ "artifactIntegrity": {
338
+ "type": "string",
339
+ "enum": [
340
+ "pass",
341
+ "fail",
342
+ "unknown",
343
+ "not_applicable"
344
+ ]
345
+ },
346
+ "producerTrust": {
347
+ "type": "string",
348
+ "enum": [
349
+ "pass",
350
+ "fail",
351
+ "unknown",
352
+ "not_applicable"
353
+ ]
354
+ },
355
+ "subjectMatch": {
356
+ "type": "string",
357
+ "enum": [
358
+ "pass",
359
+ "fail",
360
+ "unknown",
361
+ "not_applicable"
362
+ ]
363
+ },
364
+ "reasons": {
365
+ "type": "array",
366
+ "items": {
367
+ "type": "string",
368
+ "minLength": 1
369
+ }
370
+ }
371
+ },
372
+ "required": [
373
+ "artifactIntegrity",
374
+ "producerTrust",
375
+ "subjectMatch",
376
+ "reasons"
377
+ ],
378
+ "additionalProperties": false
379
+ },
380
+ "subjectRefs": {
381
+ "type": "array",
382
+ "items": {
383
+ "type": "string",
384
+ "minLength": 1
385
+ }
386
+ },
387
+ "kind": {
388
+ "type": "string",
389
+ "const": "coverage"
390
+ },
391
+ "payload": {
392
+ "type": "object",
393
+ "properties": {
394
+ "covered": {
395
+ "type": "integer",
396
+ "minimum": 0,
397
+ "maximum": 9007199254740991
398
+ },
399
+ "total": {
400
+ "type": "integer",
401
+ "minimum": 0,
402
+ "maximum": 9007199254740991
403
+ },
404
+ "excluded": {
405
+ "type": "integer",
406
+ "minimum": 0,
407
+ "maximum": 9007199254740991
408
+ },
409
+ "unobserved": {
410
+ "type": "integer",
411
+ "minimum": 0,
412
+ "maximum": 9007199254740991
413
+ }
414
+ },
415
+ "required": [
416
+ "covered",
417
+ "total",
418
+ "excluded",
419
+ "unobserved"
420
+ ],
421
+ "additionalProperties": false
422
+ }
423
+ },
424
+ "required": [
425
+ "schemaVersion",
426
+ "id",
427
+ "source",
428
+ "context",
429
+ "provenance",
430
+ "subjectRefs",
431
+ "kind",
432
+ "payload"
433
+ ],
434
+ "additionalProperties": false
435
+ },
436
+ {
437
+ "type": "object",
438
+ "properties": {
439
+ "schemaVersion": {
440
+ "type": "number",
441
+ "const": 1
442
+ },
443
+ "id": {
444
+ "type": "string",
445
+ "minLength": 1
446
+ },
447
+ "source": {
448
+ "type": "object",
449
+ "properties": {
450
+ "tool": {
451
+ "type": "string",
452
+ "minLength": 1
453
+ },
454
+ "version": {
455
+ "type": "string",
456
+ "minLength": 1
457
+ },
458
+ "artifactRef": {
459
+ "type": "string",
460
+ "minLength": 1
461
+ }
462
+ },
463
+ "required": [
464
+ "tool",
465
+ "artifactRef"
466
+ ],
467
+ "additionalProperties": false
468
+ },
469
+ "context": {
470
+ "type": "object",
471
+ "properties": {
472
+ "subject": {
473
+ "type": "object",
474
+ "properties": {
475
+ "repositoryId": {
476
+ "type": "string",
477
+ "minLength": 1
478
+ },
479
+ "prHeadSha": {
480
+ "type": "string",
481
+ "minLength": 1
482
+ },
483
+ "testedCommitSha": {
484
+ "type": "string",
485
+ "minLength": 1
486
+ },
487
+ "testedCommitParents": {
488
+ "type": "array",
489
+ "items": {
490
+ "type": "string",
491
+ "minLength": 1
492
+ }
493
+ },
494
+ "sourceTreeHash": {
495
+ "type": "string",
496
+ "pattern": "^[a-f0-9]{64}$"
497
+ },
498
+ "dirty": {
499
+ "type": "boolean"
500
+ },
501
+ "baseSha": {
502
+ "type": "string",
503
+ "minLength": 1
504
+ },
505
+ "diffBaseSha": {
506
+ "type": "string",
507
+ "minLength": 1
508
+ }
509
+ },
510
+ "required": [
511
+ "testedCommitSha",
512
+ "sourceTreeHash",
513
+ "dirty"
514
+ ],
515
+ "additionalProperties": false
516
+ },
517
+ "manifestRef": {
518
+ "type": "string",
519
+ "minLength": 1
520
+ },
521
+ "protectedPolicySha": {
522
+ "type": "string",
523
+ "minLength": 1
524
+ },
525
+ "effectivePolicyHash": {
526
+ "type": "string",
527
+ "pattern": "^[a-f0-9]{64}$"
528
+ },
529
+ "contractHash": {
530
+ "type": "string",
531
+ "pattern": "^[a-f0-9]{64}$"
532
+ },
533
+ "generatedAt": {
534
+ "type": "string",
535
+ "format": "date-time",
536
+ "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$"
537
+ },
538
+ "collectedAt": {
539
+ "type": "string",
540
+ "format": "date-time",
541
+ "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$"
542
+ }
543
+ },
544
+ "required": [
545
+ "effectivePolicyHash",
546
+ "collectedAt"
547
+ ],
548
+ "additionalProperties": false
549
+ },
550
+ "provenance": {
551
+ "type": "object",
552
+ "properties": {
553
+ "artifactIntegrity": {
554
+ "type": "string",
555
+ "enum": [
556
+ "pass",
557
+ "fail",
558
+ "unknown",
559
+ "not_applicable"
560
+ ]
561
+ },
562
+ "producerTrust": {
563
+ "type": "string",
564
+ "enum": [
565
+ "pass",
566
+ "fail",
567
+ "unknown",
568
+ "not_applicable"
569
+ ]
570
+ },
571
+ "subjectMatch": {
572
+ "type": "string",
573
+ "enum": [
574
+ "pass",
575
+ "fail",
576
+ "unknown",
577
+ "not_applicable"
578
+ ]
579
+ },
580
+ "reasons": {
581
+ "type": "array",
582
+ "items": {
583
+ "type": "string",
584
+ "minLength": 1
585
+ }
586
+ }
587
+ },
588
+ "required": [
589
+ "artifactIntegrity",
590
+ "producerTrust",
591
+ "subjectMatch",
592
+ "reasons"
593
+ ],
594
+ "additionalProperties": false
595
+ },
596
+ "subjectRefs": {
597
+ "type": "array",
598
+ "items": {
599
+ "type": "string",
600
+ "minLength": 1
601
+ }
602
+ },
603
+ "kind": {
604
+ "type": "string",
605
+ "const": "mutation"
606
+ },
607
+ "payload": {
608
+ "type": "object",
609
+ "properties": {
610
+ "killed": {
611
+ "type": "integer",
612
+ "minimum": 0,
613
+ "maximum": 9007199254740991
614
+ },
615
+ "survived": {
616
+ "type": "integer",
617
+ "minimum": 0,
618
+ "maximum": 9007199254740991
619
+ },
620
+ "noCoverage": {
621
+ "type": "integer",
622
+ "minimum": 0,
623
+ "maximum": 9007199254740991
624
+ },
625
+ "timeout": {
626
+ "type": "integer",
627
+ "minimum": 0,
628
+ "maximum": 9007199254740991
629
+ },
630
+ "excluded": {
631
+ "type": "integer",
632
+ "minimum": 0,
633
+ "maximum": 9007199254740991
634
+ },
635
+ "unobserved": {
636
+ "type": "integer",
637
+ "minimum": 0,
638
+ "maximum": 9007199254740991
639
+ }
640
+ },
641
+ "required": [
642
+ "killed",
643
+ "survived",
644
+ "noCoverage",
645
+ "timeout",
646
+ "excluded",
647
+ "unobserved"
648
+ ],
649
+ "additionalProperties": false
650
+ }
651
+ },
652
+ "required": [
653
+ "schemaVersion",
654
+ "id",
655
+ "source",
656
+ "context",
657
+ "provenance",
658
+ "subjectRefs",
659
+ "kind",
660
+ "payload"
661
+ ],
662
+ "additionalProperties": false
663
+ },
664
+ {
665
+ "type": "object",
666
+ "properties": {
667
+ "schemaVersion": {
668
+ "type": "number",
669
+ "const": 1
670
+ },
671
+ "id": {
672
+ "type": "string",
673
+ "minLength": 1
674
+ },
675
+ "source": {
676
+ "type": "object",
677
+ "properties": {
678
+ "tool": {
679
+ "type": "string",
680
+ "minLength": 1
681
+ },
682
+ "version": {
683
+ "type": "string",
684
+ "minLength": 1
685
+ },
686
+ "artifactRef": {
687
+ "type": "string",
688
+ "minLength": 1
689
+ }
690
+ },
691
+ "required": [
692
+ "tool",
693
+ "artifactRef"
694
+ ],
695
+ "additionalProperties": false
696
+ },
697
+ "context": {
698
+ "type": "object",
699
+ "properties": {
700
+ "subject": {
701
+ "type": "object",
702
+ "properties": {
703
+ "repositoryId": {
704
+ "type": "string",
705
+ "minLength": 1
706
+ },
707
+ "prHeadSha": {
708
+ "type": "string",
709
+ "minLength": 1
710
+ },
711
+ "testedCommitSha": {
712
+ "type": "string",
713
+ "minLength": 1
714
+ },
715
+ "testedCommitParents": {
716
+ "type": "array",
717
+ "items": {
718
+ "type": "string",
719
+ "minLength": 1
720
+ }
721
+ },
722
+ "sourceTreeHash": {
723
+ "type": "string",
724
+ "pattern": "^[a-f0-9]{64}$"
725
+ },
726
+ "dirty": {
727
+ "type": "boolean"
728
+ },
729
+ "baseSha": {
730
+ "type": "string",
731
+ "minLength": 1
732
+ },
733
+ "diffBaseSha": {
734
+ "type": "string",
735
+ "minLength": 1
736
+ }
737
+ },
738
+ "required": [
739
+ "testedCommitSha",
740
+ "sourceTreeHash",
741
+ "dirty"
742
+ ],
743
+ "additionalProperties": false
744
+ },
745
+ "manifestRef": {
746
+ "type": "string",
747
+ "minLength": 1
748
+ },
749
+ "protectedPolicySha": {
750
+ "type": "string",
751
+ "minLength": 1
752
+ },
753
+ "effectivePolicyHash": {
754
+ "type": "string",
755
+ "pattern": "^[a-f0-9]{64}$"
756
+ },
757
+ "contractHash": {
758
+ "type": "string",
759
+ "pattern": "^[a-f0-9]{64}$"
760
+ },
761
+ "generatedAt": {
762
+ "type": "string",
763
+ "format": "date-time",
764
+ "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$"
765
+ },
766
+ "collectedAt": {
767
+ "type": "string",
768
+ "format": "date-time",
769
+ "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$"
770
+ }
771
+ },
772
+ "required": [
773
+ "effectivePolicyHash",
774
+ "collectedAt"
775
+ ],
776
+ "additionalProperties": false
777
+ },
778
+ "provenance": {
779
+ "type": "object",
780
+ "properties": {
781
+ "artifactIntegrity": {
782
+ "type": "string",
783
+ "enum": [
784
+ "pass",
785
+ "fail",
786
+ "unknown",
787
+ "not_applicable"
788
+ ]
789
+ },
790
+ "producerTrust": {
791
+ "type": "string",
792
+ "enum": [
793
+ "pass",
794
+ "fail",
795
+ "unknown",
796
+ "not_applicable"
797
+ ]
798
+ },
799
+ "subjectMatch": {
800
+ "type": "string",
801
+ "enum": [
802
+ "pass",
803
+ "fail",
804
+ "unknown",
805
+ "not_applicable"
806
+ ]
807
+ },
808
+ "reasons": {
809
+ "type": "array",
810
+ "items": {
811
+ "type": "string",
812
+ "minLength": 1
813
+ }
814
+ }
815
+ },
816
+ "required": [
817
+ "artifactIntegrity",
818
+ "producerTrust",
819
+ "subjectMatch",
820
+ "reasons"
821
+ ],
822
+ "additionalProperties": false
823
+ },
824
+ "subjectRefs": {
825
+ "type": "array",
826
+ "items": {
827
+ "type": "string",
828
+ "minLength": 1
829
+ }
830
+ },
831
+ "kind": {
832
+ "type": "string",
833
+ "const": "pipeline"
834
+ },
835
+ "payload": {
836
+ "type": "object",
837
+ "properties": {
838
+ "status": {
839
+ "type": "string",
840
+ "enum": [
841
+ "pass",
842
+ "fail",
843
+ "unknown",
844
+ "not_applicable"
845
+ ]
846
+ },
847
+ "checks": {
848
+ "type": "array",
849
+ "items": {
850
+ "type": "object",
851
+ "properties": {
852
+ "id": {
853
+ "type": "string",
854
+ "minLength": 1
855
+ },
856
+ "status": {
857
+ "type": "string",
858
+ "enum": [
859
+ "pass",
860
+ "fail",
861
+ "unknown",
862
+ "not_applicable"
863
+ ]
864
+ }
865
+ },
866
+ "required": [
867
+ "id",
868
+ "status"
869
+ ],
870
+ "additionalProperties": false
871
+ }
872
+ }
873
+ },
874
+ "required": [
875
+ "status",
876
+ "checks"
877
+ ],
878
+ "additionalProperties": false
879
+ }
880
+ },
881
+ "required": [
882
+ "schemaVersion",
883
+ "id",
884
+ "source",
885
+ "context",
886
+ "provenance",
887
+ "subjectRefs",
888
+ "kind",
889
+ "payload"
890
+ ],
891
+ "additionalProperties": false
892
+ },
893
+ {
894
+ "type": "object",
895
+ "properties": {
896
+ "schemaVersion": {
897
+ "type": "number",
898
+ "const": 1
899
+ },
900
+ "id": {
901
+ "type": "string",
902
+ "minLength": 1
903
+ },
904
+ "source": {
905
+ "type": "object",
906
+ "properties": {
907
+ "tool": {
908
+ "type": "string",
909
+ "minLength": 1
910
+ },
911
+ "version": {
912
+ "type": "string",
913
+ "minLength": 1
914
+ },
915
+ "artifactRef": {
916
+ "type": "string",
917
+ "minLength": 1
918
+ }
919
+ },
920
+ "required": [
921
+ "tool",
922
+ "artifactRef"
923
+ ],
924
+ "additionalProperties": false
925
+ },
926
+ "context": {
927
+ "type": "object",
928
+ "properties": {
929
+ "subject": {
930
+ "type": "object",
931
+ "properties": {
932
+ "repositoryId": {
933
+ "type": "string",
934
+ "minLength": 1
935
+ },
936
+ "prHeadSha": {
937
+ "type": "string",
938
+ "minLength": 1
939
+ },
940
+ "testedCommitSha": {
941
+ "type": "string",
942
+ "minLength": 1
943
+ },
944
+ "testedCommitParents": {
945
+ "type": "array",
946
+ "items": {
947
+ "type": "string",
948
+ "minLength": 1
949
+ }
950
+ },
951
+ "sourceTreeHash": {
952
+ "type": "string",
953
+ "pattern": "^[a-f0-9]{64}$"
954
+ },
955
+ "dirty": {
956
+ "type": "boolean"
957
+ },
958
+ "baseSha": {
959
+ "type": "string",
960
+ "minLength": 1
961
+ },
962
+ "diffBaseSha": {
963
+ "type": "string",
964
+ "minLength": 1
965
+ }
966
+ },
967
+ "required": [
968
+ "testedCommitSha",
969
+ "sourceTreeHash",
970
+ "dirty"
971
+ ],
972
+ "additionalProperties": false
973
+ },
974
+ "manifestRef": {
975
+ "type": "string",
976
+ "minLength": 1
977
+ },
978
+ "protectedPolicySha": {
979
+ "type": "string",
980
+ "minLength": 1
981
+ },
982
+ "effectivePolicyHash": {
983
+ "type": "string",
984
+ "pattern": "^[a-f0-9]{64}$"
985
+ },
986
+ "contractHash": {
987
+ "type": "string",
988
+ "pattern": "^[a-f0-9]{64}$"
989
+ },
990
+ "generatedAt": {
991
+ "type": "string",
992
+ "format": "date-time",
993
+ "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$"
994
+ },
995
+ "collectedAt": {
996
+ "type": "string",
997
+ "format": "date-time",
998
+ "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$"
999
+ }
1000
+ },
1001
+ "required": [
1002
+ "effectivePolicyHash",
1003
+ "collectedAt"
1004
+ ],
1005
+ "additionalProperties": false
1006
+ },
1007
+ "provenance": {
1008
+ "type": "object",
1009
+ "properties": {
1010
+ "artifactIntegrity": {
1011
+ "type": "string",
1012
+ "enum": [
1013
+ "pass",
1014
+ "fail",
1015
+ "unknown",
1016
+ "not_applicable"
1017
+ ]
1018
+ },
1019
+ "producerTrust": {
1020
+ "type": "string",
1021
+ "enum": [
1022
+ "pass",
1023
+ "fail",
1024
+ "unknown",
1025
+ "not_applicable"
1026
+ ]
1027
+ },
1028
+ "subjectMatch": {
1029
+ "type": "string",
1030
+ "enum": [
1031
+ "pass",
1032
+ "fail",
1033
+ "unknown",
1034
+ "not_applicable"
1035
+ ]
1036
+ },
1037
+ "reasons": {
1038
+ "type": "array",
1039
+ "items": {
1040
+ "type": "string",
1041
+ "minLength": 1
1042
+ }
1043
+ }
1044
+ },
1045
+ "required": [
1046
+ "artifactIntegrity",
1047
+ "producerTrust",
1048
+ "subjectMatch",
1049
+ "reasons"
1050
+ ],
1051
+ "additionalProperties": false
1052
+ },
1053
+ "subjectRefs": {
1054
+ "type": "array",
1055
+ "items": {
1056
+ "type": "string",
1057
+ "minLength": 1
1058
+ }
1059
+ },
1060
+ "kind": {
1061
+ "type": "string",
1062
+ "const": "contract_execution"
1063
+ },
1064
+ "payload": {
1065
+ "type": "object",
1066
+ "properties": {
1067
+ "contractId": {
1068
+ "type": "string",
1069
+ "minLength": 1
1070
+ },
1071
+ "caseId": {
1072
+ "type": "string",
1073
+ "minLength": 1
1074
+ },
1075
+ "revisionHash": {
1076
+ "type": "string",
1077
+ "pattern": "^[a-f0-9]{64}$"
1078
+ },
1079
+ "bindingHash": {
1080
+ "type": "string",
1081
+ "pattern": "^[a-f0-9]{64}$"
1082
+ },
1083
+ "comparisonCount": {
1084
+ "type": "integer",
1085
+ "minimum": 0,
1086
+ "maximum": 9007199254740991
1087
+ },
1088
+ "status": {
1089
+ "type": "string",
1090
+ "enum": [
1091
+ "pass",
1092
+ "fail",
1093
+ "unknown",
1094
+ "not_applicable"
1095
+ ]
1096
+ }
1097
+ },
1098
+ "required": [
1099
+ "contractId",
1100
+ "caseId",
1101
+ "revisionHash",
1102
+ "bindingHash",
1103
+ "comparisonCount",
1104
+ "status"
1105
+ ],
1106
+ "additionalProperties": false
1107
+ }
1108
+ },
1109
+ "required": [
1110
+ "schemaVersion",
1111
+ "id",
1112
+ "source",
1113
+ "context",
1114
+ "provenance",
1115
+ "subjectRefs",
1116
+ "kind",
1117
+ "payload"
1118
+ ],
1119
+ "additionalProperties": false
1120
+ },
1121
+ {
1122
+ "type": "object",
1123
+ "properties": {
1124
+ "schemaVersion": {
1125
+ "type": "number",
1126
+ "const": 1
1127
+ },
1128
+ "id": {
1129
+ "type": "string",
1130
+ "minLength": 1
1131
+ },
1132
+ "source": {
1133
+ "type": "object",
1134
+ "properties": {
1135
+ "tool": {
1136
+ "type": "string",
1137
+ "minLength": 1
1138
+ },
1139
+ "version": {
1140
+ "type": "string",
1141
+ "minLength": 1
1142
+ },
1143
+ "artifactRef": {
1144
+ "type": "string",
1145
+ "minLength": 1
1146
+ }
1147
+ },
1148
+ "required": [
1149
+ "tool",
1150
+ "artifactRef"
1151
+ ],
1152
+ "additionalProperties": false
1153
+ },
1154
+ "context": {
1155
+ "type": "object",
1156
+ "properties": {
1157
+ "subject": {
1158
+ "type": "object",
1159
+ "properties": {
1160
+ "repositoryId": {
1161
+ "type": "string",
1162
+ "minLength": 1
1163
+ },
1164
+ "prHeadSha": {
1165
+ "type": "string",
1166
+ "minLength": 1
1167
+ },
1168
+ "testedCommitSha": {
1169
+ "type": "string",
1170
+ "minLength": 1
1171
+ },
1172
+ "testedCommitParents": {
1173
+ "type": "array",
1174
+ "items": {
1175
+ "type": "string",
1176
+ "minLength": 1
1177
+ }
1178
+ },
1179
+ "sourceTreeHash": {
1180
+ "type": "string",
1181
+ "pattern": "^[a-f0-9]{64}$"
1182
+ },
1183
+ "dirty": {
1184
+ "type": "boolean"
1185
+ },
1186
+ "baseSha": {
1187
+ "type": "string",
1188
+ "minLength": 1
1189
+ },
1190
+ "diffBaseSha": {
1191
+ "type": "string",
1192
+ "minLength": 1
1193
+ }
1194
+ },
1195
+ "required": [
1196
+ "testedCommitSha",
1197
+ "sourceTreeHash",
1198
+ "dirty"
1199
+ ],
1200
+ "additionalProperties": false
1201
+ },
1202
+ "manifestRef": {
1203
+ "type": "string",
1204
+ "minLength": 1
1205
+ },
1206
+ "protectedPolicySha": {
1207
+ "type": "string",
1208
+ "minLength": 1
1209
+ },
1210
+ "effectivePolicyHash": {
1211
+ "type": "string",
1212
+ "pattern": "^[a-f0-9]{64}$"
1213
+ },
1214
+ "contractHash": {
1215
+ "type": "string",
1216
+ "pattern": "^[a-f0-9]{64}$"
1217
+ },
1218
+ "generatedAt": {
1219
+ "type": "string",
1220
+ "format": "date-time",
1221
+ "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$"
1222
+ },
1223
+ "collectedAt": {
1224
+ "type": "string",
1225
+ "format": "date-time",
1226
+ "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$"
1227
+ }
1228
+ },
1229
+ "required": [
1230
+ "effectivePolicyHash",
1231
+ "collectedAt"
1232
+ ],
1233
+ "additionalProperties": false
1234
+ },
1235
+ "provenance": {
1236
+ "type": "object",
1237
+ "properties": {
1238
+ "artifactIntegrity": {
1239
+ "type": "string",
1240
+ "enum": [
1241
+ "pass",
1242
+ "fail",
1243
+ "unknown",
1244
+ "not_applicable"
1245
+ ]
1246
+ },
1247
+ "producerTrust": {
1248
+ "type": "string",
1249
+ "enum": [
1250
+ "pass",
1251
+ "fail",
1252
+ "unknown",
1253
+ "not_applicable"
1254
+ ]
1255
+ },
1256
+ "subjectMatch": {
1257
+ "type": "string",
1258
+ "enum": [
1259
+ "pass",
1260
+ "fail",
1261
+ "unknown",
1262
+ "not_applicable"
1263
+ ]
1264
+ },
1265
+ "reasons": {
1266
+ "type": "array",
1267
+ "items": {
1268
+ "type": "string",
1269
+ "minLength": 1
1270
+ }
1271
+ }
1272
+ },
1273
+ "required": [
1274
+ "artifactIntegrity",
1275
+ "producerTrust",
1276
+ "subjectMatch",
1277
+ "reasons"
1278
+ ],
1279
+ "additionalProperties": false
1280
+ },
1281
+ "subjectRefs": {
1282
+ "type": "array",
1283
+ "items": {
1284
+ "type": "string",
1285
+ "minLength": 1
1286
+ }
1287
+ },
1288
+ "kind": {
1289
+ "type": "string",
1290
+ "const": "approval"
1291
+ },
1292
+ "payload": {
1293
+ "type": "object",
1294
+ "properties": {
1295
+ "schemaVersion": {
1296
+ "type": "number",
1297
+ "const": 1
1298
+ },
1299
+ "id": {
1300
+ "type": "string",
1301
+ "minLength": 1
1302
+ },
1303
+ "target": {
1304
+ "type": "object",
1305
+ "properties": {
1306
+ "kind": {
1307
+ "type": "string",
1308
+ "enum": [
1309
+ "intent",
1310
+ "contract",
1311
+ "policy",
1312
+ "registry"
1313
+ ]
1314
+ },
1315
+ "id": {
1316
+ "type": "string",
1317
+ "minLength": 1
1318
+ },
1319
+ "contentHash": {
1320
+ "type": "string",
1321
+ "pattern": "^[a-f0-9]{64}$"
1322
+ }
1323
+ },
1324
+ "required": [
1325
+ "kind",
1326
+ "id",
1327
+ "contentHash"
1328
+ ],
1329
+ "additionalProperties": false
1330
+ },
1331
+ "status": {
1332
+ "type": "string",
1333
+ "enum": [
1334
+ "pass",
1335
+ "fail",
1336
+ "unknown",
1337
+ "not_applicable"
1338
+ ]
1339
+ },
1340
+ "source": {
1341
+ "type": "object",
1342
+ "properties": {
1343
+ "provider": {
1344
+ "type": "string",
1345
+ "minLength": 1
1346
+ },
1347
+ "ref": {
1348
+ "type": "string",
1349
+ "minLength": 1
1350
+ }
1351
+ },
1352
+ "required": [
1353
+ "provider",
1354
+ "ref"
1355
+ ],
1356
+ "additionalProperties": false
1357
+ },
1358
+ "approvedBy": {
1359
+ "type": "array",
1360
+ "items": {
1361
+ "type": "string",
1362
+ "minLength": 1
1363
+ }
1364
+ },
1365
+ "subjectCommitSha": {
1366
+ "type": "string",
1367
+ "minLength": 1
1368
+ },
1369
+ "reasons": {
1370
+ "type": "array",
1371
+ "items": {
1372
+ "type": "string",
1373
+ "minLength": 1
1374
+ }
1375
+ }
1376
+ },
1377
+ "required": [
1378
+ "schemaVersion",
1379
+ "id",
1380
+ "target",
1381
+ "status",
1382
+ "source",
1383
+ "approvedBy",
1384
+ "reasons"
1385
+ ],
1386
+ "additionalProperties": false
1387
+ }
1388
+ },
1389
+ "required": [
1390
+ "schemaVersion",
1391
+ "id",
1392
+ "source",
1393
+ "context",
1394
+ "provenance",
1395
+ "subjectRefs",
1396
+ "kind",
1397
+ "payload"
1398
+ ],
1399
+ "additionalProperties": false
1400
+ },
1401
+ {
1402
+ "type": "object",
1403
+ "properties": {
1404
+ "schemaVersion": {
1405
+ "type": "number",
1406
+ "const": 1
1407
+ },
1408
+ "id": {
1409
+ "type": "string",
1410
+ "minLength": 1
1411
+ },
1412
+ "source": {
1413
+ "type": "object",
1414
+ "properties": {
1415
+ "tool": {
1416
+ "type": "string",
1417
+ "minLength": 1
1418
+ },
1419
+ "version": {
1420
+ "type": "string",
1421
+ "minLength": 1
1422
+ },
1423
+ "artifactRef": {
1424
+ "type": "string",
1425
+ "minLength": 1
1426
+ }
1427
+ },
1428
+ "required": [
1429
+ "tool",
1430
+ "artifactRef"
1431
+ ],
1432
+ "additionalProperties": false
1433
+ },
1434
+ "context": {
1435
+ "type": "object",
1436
+ "properties": {
1437
+ "subject": {
1438
+ "type": "object",
1439
+ "properties": {
1440
+ "repositoryId": {
1441
+ "type": "string",
1442
+ "minLength": 1
1443
+ },
1444
+ "prHeadSha": {
1445
+ "type": "string",
1446
+ "minLength": 1
1447
+ },
1448
+ "testedCommitSha": {
1449
+ "type": "string",
1450
+ "minLength": 1
1451
+ },
1452
+ "testedCommitParents": {
1453
+ "type": "array",
1454
+ "items": {
1455
+ "type": "string",
1456
+ "minLength": 1
1457
+ }
1458
+ },
1459
+ "sourceTreeHash": {
1460
+ "type": "string",
1461
+ "pattern": "^[a-f0-9]{64}$"
1462
+ },
1463
+ "dirty": {
1464
+ "type": "boolean"
1465
+ },
1466
+ "baseSha": {
1467
+ "type": "string",
1468
+ "minLength": 1
1469
+ },
1470
+ "diffBaseSha": {
1471
+ "type": "string",
1472
+ "minLength": 1
1473
+ }
1474
+ },
1475
+ "required": [
1476
+ "testedCommitSha",
1477
+ "sourceTreeHash",
1478
+ "dirty"
1479
+ ],
1480
+ "additionalProperties": false
1481
+ },
1482
+ "manifestRef": {
1483
+ "type": "string",
1484
+ "minLength": 1
1485
+ },
1486
+ "protectedPolicySha": {
1487
+ "type": "string",
1488
+ "minLength": 1
1489
+ },
1490
+ "effectivePolicyHash": {
1491
+ "type": "string",
1492
+ "pattern": "^[a-f0-9]{64}$"
1493
+ },
1494
+ "contractHash": {
1495
+ "type": "string",
1496
+ "pattern": "^[a-f0-9]{64}$"
1497
+ },
1498
+ "generatedAt": {
1499
+ "type": "string",
1500
+ "format": "date-time",
1501
+ "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$"
1502
+ },
1503
+ "collectedAt": {
1504
+ "type": "string",
1505
+ "format": "date-time",
1506
+ "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$"
1507
+ }
1508
+ },
1509
+ "required": [
1510
+ "effectivePolicyHash",
1511
+ "collectedAt"
1512
+ ],
1513
+ "additionalProperties": false
1514
+ },
1515
+ "provenance": {
1516
+ "type": "object",
1517
+ "properties": {
1518
+ "artifactIntegrity": {
1519
+ "type": "string",
1520
+ "enum": [
1521
+ "pass",
1522
+ "fail",
1523
+ "unknown",
1524
+ "not_applicable"
1525
+ ]
1526
+ },
1527
+ "producerTrust": {
1528
+ "type": "string",
1529
+ "enum": [
1530
+ "pass",
1531
+ "fail",
1532
+ "unknown",
1533
+ "not_applicable"
1534
+ ]
1535
+ },
1536
+ "subjectMatch": {
1537
+ "type": "string",
1538
+ "enum": [
1539
+ "pass",
1540
+ "fail",
1541
+ "unknown",
1542
+ "not_applicable"
1543
+ ]
1544
+ },
1545
+ "reasons": {
1546
+ "type": "array",
1547
+ "items": {
1548
+ "type": "string",
1549
+ "minLength": 1
1550
+ }
1551
+ }
1552
+ },
1553
+ "required": [
1554
+ "artifactIntegrity",
1555
+ "producerTrust",
1556
+ "subjectMatch",
1557
+ "reasons"
1558
+ ],
1559
+ "additionalProperties": false
1560
+ },
1561
+ "subjectRefs": {
1562
+ "type": "array",
1563
+ "items": {
1564
+ "type": "string",
1565
+ "minLength": 1
1566
+ }
1567
+ },
1568
+ "kind": {
1569
+ "type": "string",
1570
+ "const": "execution_manifest"
1571
+ },
1572
+ "payload": {
1573
+ "type": "object",
1574
+ "properties": {
1575
+ "schemaVersion": {
1576
+ "type": "number",
1577
+ "const": 1
1578
+ },
1579
+ "executionId": {
1580
+ "type": "string",
1581
+ "minLength": 1
1582
+ },
1583
+ "subject": {
1584
+ "type": "object",
1585
+ "properties": {
1586
+ "repositoryId": {
1587
+ "type": "string",
1588
+ "minLength": 1
1589
+ },
1590
+ "prHeadSha": {
1591
+ "type": "string",
1592
+ "minLength": 1
1593
+ },
1594
+ "testedCommitSha": {
1595
+ "type": "string",
1596
+ "minLength": 1
1597
+ },
1598
+ "testedCommitParents": {
1599
+ "type": "array",
1600
+ "items": {
1601
+ "type": "string",
1602
+ "minLength": 1
1603
+ }
1604
+ },
1605
+ "sourceTreeHash": {
1606
+ "type": "string",
1607
+ "pattern": "^[a-f0-9]{64}$"
1608
+ },
1609
+ "dirty": {
1610
+ "type": "boolean"
1611
+ },
1612
+ "baseSha": {
1613
+ "type": "string",
1614
+ "minLength": 1
1615
+ },
1616
+ "diffBaseSha": {
1617
+ "type": "string",
1618
+ "minLength": 1
1619
+ }
1620
+ },
1621
+ "required": [
1622
+ "testedCommitSha",
1623
+ "sourceTreeHash",
1624
+ "dirty"
1625
+ ],
1626
+ "additionalProperties": false
1627
+ },
1628
+ "producer": {
1629
+ "type": "object",
1630
+ "properties": {
1631
+ "tool": {
1632
+ "type": "string",
1633
+ "minLength": 1
1634
+ },
1635
+ "version": {
1636
+ "type": "string",
1637
+ "minLength": 1
1638
+ },
1639
+ "collectorVersion": {
1640
+ "type": "string",
1641
+ "minLength": 1
1642
+ }
1643
+ },
1644
+ "required": [
1645
+ "tool",
1646
+ "version",
1647
+ "collectorVersion"
1648
+ ],
1649
+ "additionalProperties": false
1650
+ },
1651
+ "commandHash": {
1652
+ "type": "string",
1653
+ "pattern": "^[a-f0-9]{64}$"
1654
+ },
1655
+ "configHashes": {
1656
+ "type": "object",
1657
+ "propertyNames": {
1658
+ "type": "string",
1659
+ "minLength": 1
1660
+ },
1661
+ "additionalProperties": {
1662
+ "type": "string",
1663
+ "pattern": "^[a-f0-9]{64}$"
1664
+ }
1665
+ },
1666
+ "dependencyLockHash": {
1667
+ "type": "string",
1668
+ "pattern": "^[a-f0-9]{64}$"
1669
+ },
1670
+ "environment": {
1671
+ "type": "object",
1672
+ "properties": {
1673
+ "nodeVersion": {
1674
+ "type": "string",
1675
+ "minLength": 1
1676
+ },
1677
+ "platform": {
1678
+ "type": "string",
1679
+ "minLength": 1
1680
+ }
1681
+ },
1682
+ "required": [
1683
+ "nodeVersion",
1684
+ "platform"
1685
+ ],
1686
+ "additionalProperties": false
1687
+ },
1688
+ "startedAt": {
1689
+ "type": "string",
1690
+ "format": "date-time",
1691
+ "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$"
1692
+ },
1693
+ "completedAt": {
1694
+ "type": "string",
1695
+ "format": "date-time",
1696
+ "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$"
1697
+ },
1698
+ "exitCode": {
1699
+ "type": "integer",
1700
+ "minimum": -9007199254740991,
1701
+ "maximum": 9007199254740991
1702
+ },
1703
+ "artifacts": {
1704
+ "type": "array",
1705
+ "items": {
1706
+ "type": "object",
1707
+ "properties": {
1708
+ "ref": {
1709
+ "type": "string",
1710
+ "minLength": 1
1711
+ },
1712
+ "sha256": {
1713
+ "type": "string",
1714
+ "pattern": "^[a-f0-9]{64}$"
1715
+ },
1716
+ "kind": {
1717
+ "type": "string",
1718
+ "minLength": 1
1719
+ },
1720
+ "scope": {
1721
+ "type": "array",
1722
+ "items": {
1723
+ "type": "string",
1724
+ "minLength": 1
1725
+ }
1726
+ }
1727
+ },
1728
+ "required": [
1729
+ "ref",
1730
+ "sha256",
1731
+ "kind",
1732
+ "scope"
1733
+ ],
1734
+ "additionalProperties": false
1735
+ }
1736
+ },
1737
+ "ci": {
1738
+ "type": "object",
1739
+ "properties": {
1740
+ "repositoryId": {
1741
+ "type": "string",
1742
+ "minLength": 1
1743
+ },
1744
+ "workflowRef": {
1745
+ "type": "string",
1746
+ "minLength": 1
1747
+ },
1748
+ "runId": {
1749
+ "type": "string",
1750
+ "minLength": 1
1751
+ },
1752
+ "runAttempt": {
1753
+ "type": "integer",
1754
+ "minimum": 1,
1755
+ "maximum": 9007199254740991
1756
+ },
1757
+ "jobId": {
1758
+ "type": "string",
1759
+ "minLength": 1
1760
+ },
1761
+ "eventName": {
1762
+ "type": "string",
1763
+ "minLength": 1
1764
+ }
1765
+ },
1766
+ "required": [
1767
+ "repositoryId",
1768
+ "workflowRef",
1769
+ "runId",
1770
+ "runAttempt",
1771
+ "jobId",
1772
+ "eventName"
1773
+ ],
1774
+ "additionalProperties": false
1775
+ },
1776
+ "attestationRef": {
1777
+ "type": "string",
1778
+ "minLength": 1
1779
+ }
1780
+ },
1781
+ "required": [
1782
+ "schemaVersion",
1783
+ "executionId",
1784
+ "subject",
1785
+ "producer",
1786
+ "commandHash",
1787
+ "configHashes",
1788
+ "environment",
1789
+ "startedAt",
1790
+ "completedAt",
1791
+ "exitCode",
1792
+ "artifacts"
1793
+ ],
1794
+ "additionalProperties": false
1795
+ }
1796
+ },
1797
+ "required": [
1798
+ "schemaVersion",
1799
+ "id",
1800
+ "source",
1801
+ "context",
1802
+ "provenance",
1803
+ "subjectRefs",
1804
+ "kind",
1805
+ "payload"
1806
+ ],
1807
+ "additionalProperties": false
1808
+ },
1809
+ {
1810
+ "type": "object",
1811
+ "properties": {
1812
+ "schemaVersion": {
1813
+ "type": "number",
1814
+ "const": 1
1815
+ },
1816
+ "id": {
1817
+ "type": "string",
1818
+ "minLength": 1
1819
+ },
1820
+ "source": {
1821
+ "type": "object",
1822
+ "properties": {
1823
+ "tool": {
1824
+ "type": "string",
1825
+ "minLength": 1
1826
+ },
1827
+ "version": {
1828
+ "type": "string",
1829
+ "minLength": 1
1830
+ },
1831
+ "artifactRef": {
1832
+ "type": "string",
1833
+ "minLength": 1
1834
+ }
1835
+ },
1836
+ "required": [
1837
+ "tool",
1838
+ "artifactRef"
1839
+ ],
1840
+ "additionalProperties": false
1841
+ },
1842
+ "context": {
1843
+ "type": "object",
1844
+ "properties": {
1845
+ "subject": {
1846
+ "type": "object",
1847
+ "properties": {
1848
+ "repositoryId": {
1849
+ "type": "string",
1850
+ "minLength": 1
1851
+ },
1852
+ "prHeadSha": {
1853
+ "type": "string",
1854
+ "minLength": 1
1855
+ },
1856
+ "testedCommitSha": {
1857
+ "type": "string",
1858
+ "minLength": 1
1859
+ },
1860
+ "testedCommitParents": {
1861
+ "type": "array",
1862
+ "items": {
1863
+ "type": "string",
1864
+ "minLength": 1
1865
+ }
1866
+ },
1867
+ "sourceTreeHash": {
1868
+ "type": "string",
1869
+ "pattern": "^[a-f0-9]{64}$"
1870
+ },
1871
+ "dirty": {
1872
+ "type": "boolean"
1873
+ },
1874
+ "baseSha": {
1875
+ "type": "string",
1876
+ "minLength": 1
1877
+ },
1878
+ "diffBaseSha": {
1879
+ "type": "string",
1880
+ "minLength": 1
1881
+ }
1882
+ },
1883
+ "required": [
1884
+ "testedCommitSha",
1885
+ "sourceTreeHash",
1886
+ "dirty"
1887
+ ],
1888
+ "additionalProperties": false
1889
+ },
1890
+ "manifestRef": {
1891
+ "type": "string",
1892
+ "minLength": 1
1893
+ },
1894
+ "protectedPolicySha": {
1895
+ "type": "string",
1896
+ "minLength": 1
1897
+ },
1898
+ "effectivePolicyHash": {
1899
+ "type": "string",
1900
+ "pattern": "^[a-f0-9]{64}$"
1901
+ },
1902
+ "contractHash": {
1903
+ "type": "string",
1904
+ "pattern": "^[a-f0-9]{64}$"
1905
+ },
1906
+ "generatedAt": {
1907
+ "type": "string",
1908
+ "format": "date-time",
1909
+ "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$"
1910
+ },
1911
+ "collectedAt": {
1912
+ "type": "string",
1913
+ "format": "date-time",
1914
+ "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$"
1915
+ }
1916
+ },
1917
+ "required": [
1918
+ "effectivePolicyHash",
1919
+ "collectedAt"
1920
+ ],
1921
+ "additionalProperties": false
1922
+ },
1923
+ "provenance": {
1924
+ "type": "object",
1925
+ "properties": {
1926
+ "artifactIntegrity": {
1927
+ "type": "string",
1928
+ "enum": [
1929
+ "pass",
1930
+ "fail",
1931
+ "unknown",
1932
+ "not_applicable"
1933
+ ]
1934
+ },
1935
+ "producerTrust": {
1936
+ "type": "string",
1937
+ "enum": [
1938
+ "pass",
1939
+ "fail",
1940
+ "unknown",
1941
+ "not_applicable"
1942
+ ]
1943
+ },
1944
+ "subjectMatch": {
1945
+ "type": "string",
1946
+ "enum": [
1947
+ "pass",
1948
+ "fail",
1949
+ "unknown",
1950
+ "not_applicable"
1951
+ ]
1952
+ },
1953
+ "reasons": {
1954
+ "type": "array",
1955
+ "items": {
1956
+ "type": "string",
1957
+ "minLength": 1
1958
+ }
1959
+ }
1960
+ },
1961
+ "required": [
1962
+ "artifactIntegrity",
1963
+ "producerTrust",
1964
+ "subjectMatch",
1965
+ "reasons"
1966
+ ],
1967
+ "additionalProperties": false
1968
+ },
1969
+ "subjectRefs": {
1970
+ "type": "array",
1971
+ "items": {
1972
+ "type": "string",
1973
+ "minLength": 1
1974
+ }
1975
+ },
1976
+ "kind": {
1977
+ "type": "string",
1978
+ "const": "target_observation"
1979
+ },
1980
+ "payload": {
1981
+ "type": "object",
1982
+ "properties": {
1983
+ "contractId": {
1984
+ "type": "string",
1985
+ "minLength": 1
1986
+ },
1987
+ "caseIds": {
1988
+ "type": "array",
1989
+ "items": {
1990
+ "type": "string",
1991
+ "minLength": 1
1992
+ }
1993
+ },
1994
+ "targetRef": {
1995
+ "type": "string",
1996
+ "minLength": 1
1997
+ },
1998
+ "method": {
1999
+ "type": "string",
2000
+ "minLength": 1
2001
+ },
2002
+ "observations": {
2003
+ "type": "integer",
2004
+ "minimum": 0,
2005
+ "maximum": 9007199254740991
2006
+ },
2007
+ "status": {
2008
+ "type": "string",
2009
+ "enum": [
2010
+ "pass",
2011
+ "fail",
2012
+ "unknown",
2013
+ "not_applicable"
2014
+ ]
2015
+ }
2016
+ },
2017
+ "required": [
2018
+ "contractId",
2019
+ "caseIds",
2020
+ "targetRef",
2021
+ "method",
2022
+ "observations",
2023
+ "status"
2024
+ ],
2025
+ "additionalProperties": false
2026
+ }
2027
+ },
2028
+ "required": [
2029
+ "schemaVersion",
2030
+ "id",
2031
+ "source",
2032
+ "context",
2033
+ "provenance",
2034
+ "subjectRefs",
2035
+ "kind",
2036
+ "payload"
2037
+ ],
2038
+ "additionalProperties": false
2039
+ },
2040
+ {
2041
+ "type": "object",
2042
+ "properties": {
2043
+ "schemaVersion": {
2044
+ "type": "number",
2045
+ "const": 1
2046
+ },
2047
+ "id": {
2048
+ "type": "string",
2049
+ "minLength": 1
2050
+ },
2051
+ "source": {
2052
+ "type": "object",
2053
+ "properties": {
2054
+ "tool": {
2055
+ "type": "string",
2056
+ "minLength": 1
2057
+ },
2058
+ "version": {
2059
+ "type": "string",
2060
+ "minLength": 1
2061
+ },
2062
+ "artifactRef": {
2063
+ "type": "string",
2064
+ "minLength": 1
2065
+ }
2066
+ },
2067
+ "required": [
2068
+ "tool",
2069
+ "artifactRef"
2070
+ ],
2071
+ "additionalProperties": false
2072
+ },
2073
+ "context": {
2074
+ "type": "object",
2075
+ "properties": {
2076
+ "subject": {
2077
+ "type": "object",
2078
+ "properties": {
2079
+ "repositoryId": {
2080
+ "type": "string",
2081
+ "minLength": 1
2082
+ },
2083
+ "prHeadSha": {
2084
+ "type": "string",
2085
+ "minLength": 1
2086
+ },
2087
+ "testedCommitSha": {
2088
+ "type": "string",
2089
+ "minLength": 1
2090
+ },
2091
+ "testedCommitParents": {
2092
+ "type": "array",
2093
+ "items": {
2094
+ "type": "string",
2095
+ "minLength": 1
2096
+ }
2097
+ },
2098
+ "sourceTreeHash": {
2099
+ "type": "string",
2100
+ "pattern": "^[a-f0-9]{64}$"
2101
+ },
2102
+ "dirty": {
2103
+ "type": "boolean"
2104
+ },
2105
+ "baseSha": {
2106
+ "type": "string",
2107
+ "minLength": 1
2108
+ },
2109
+ "diffBaseSha": {
2110
+ "type": "string",
2111
+ "minLength": 1
2112
+ }
2113
+ },
2114
+ "required": [
2115
+ "testedCommitSha",
2116
+ "sourceTreeHash",
2117
+ "dirty"
2118
+ ],
2119
+ "additionalProperties": false
2120
+ },
2121
+ "manifestRef": {
2122
+ "type": "string",
2123
+ "minLength": 1
2124
+ },
2125
+ "protectedPolicySha": {
2126
+ "type": "string",
2127
+ "minLength": 1
2128
+ },
2129
+ "effectivePolicyHash": {
2130
+ "type": "string",
2131
+ "pattern": "^[a-f0-9]{64}$"
2132
+ },
2133
+ "contractHash": {
2134
+ "type": "string",
2135
+ "pattern": "^[a-f0-9]{64}$"
2136
+ },
2137
+ "generatedAt": {
2138
+ "type": "string",
2139
+ "format": "date-time",
2140
+ "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$"
2141
+ },
2142
+ "collectedAt": {
2143
+ "type": "string",
2144
+ "format": "date-time",
2145
+ "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$"
2146
+ }
2147
+ },
2148
+ "required": [
2149
+ "effectivePolicyHash",
2150
+ "collectedAt"
2151
+ ],
2152
+ "additionalProperties": false
2153
+ },
2154
+ "provenance": {
2155
+ "type": "object",
2156
+ "properties": {
2157
+ "artifactIntegrity": {
2158
+ "type": "string",
2159
+ "enum": [
2160
+ "pass",
2161
+ "fail",
2162
+ "unknown",
2163
+ "not_applicable"
2164
+ ]
2165
+ },
2166
+ "producerTrust": {
2167
+ "type": "string",
2168
+ "enum": [
2169
+ "pass",
2170
+ "fail",
2171
+ "unknown",
2172
+ "not_applicable"
2173
+ ]
2174
+ },
2175
+ "subjectMatch": {
2176
+ "type": "string",
2177
+ "enum": [
2178
+ "pass",
2179
+ "fail",
2180
+ "unknown",
2181
+ "not_applicable"
2182
+ ]
2183
+ },
2184
+ "reasons": {
2185
+ "type": "array",
2186
+ "items": {
2187
+ "type": "string",
2188
+ "minLength": 1
2189
+ }
2190
+ }
2191
+ },
2192
+ "required": [
2193
+ "artifactIntegrity",
2194
+ "producerTrust",
2195
+ "subjectMatch",
2196
+ "reasons"
2197
+ ],
2198
+ "additionalProperties": false
2199
+ },
2200
+ "subjectRefs": {
2201
+ "type": "array",
2202
+ "items": {
2203
+ "type": "string",
2204
+ "minLength": 1
2205
+ }
2206
+ },
2207
+ "kind": {
2208
+ "type": "string",
2209
+ "const": "canary"
2210
+ },
2211
+ "payload": {
2212
+ "type": "object",
2213
+ "properties": {
2214
+ "contractId": {
2215
+ "type": "string",
2216
+ "minLength": 1
2217
+ },
2218
+ "caseIds": {
2219
+ "type": "array",
2220
+ "items": {
2221
+ "type": "string",
2222
+ "minLength": 1
2223
+ }
2224
+ },
2225
+ "targetRef": {
2226
+ "type": "string",
2227
+ "minLength": 1
2228
+ },
2229
+ "method": {
2230
+ "type": "string",
2231
+ "minLength": 1
2232
+ },
2233
+ "detected": {
2234
+ "type": "integer",
2235
+ "minimum": 0,
2236
+ "maximum": 9007199254740991
2237
+ },
2238
+ "total": {
2239
+ "type": "integer",
2240
+ "minimum": 0,
2241
+ "maximum": 9007199254740991
2242
+ },
2243
+ "status": {
2244
+ "type": "string",
2245
+ "enum": [
2246
+ "pass",
2247
+ "fail",
2248
+ "unknown",
2249
+ "not_applicable"
2250
+ ]
2251
+ }
2252
+ },
2253
+ "required": [
2254
+ "contractId",
2255
+ "caseIds",
2256
+ "targetRef",
2257
+ "method",
2258
+ "detected",
2259
+ "total",
2260
+ "status"
2261
+ ],
2262
+ "additionalProperties": false
2263
+ }
2264
+ },
2265
+ "required": [
2266
+ "schemaVersion",
2267
+ "id",
2268
+ "source",
2269
+ "context",
2270
+ "provenance",
2271
+ "subjectRefs",
2272
+ "kind",
2273
+ "payload"
2274
+ ],
2275
+ "additionalProperties": false
2276
+ },
2277
+ {
2278
+ "type": "object",
2279
+ "properties": {
2280
+ "schemaVersion": {
2281
+ "type": "number",
2282
+ "const": 1
2283
+ },
2284
+ "id": {
2285
+ "type": "string",
2286
+ "minLength": 1
2287
+ },
2288
+ "source": {
2289
+ "type": "object",
2290
+ "properties": {
2291
+ "tool": {
2292
+ "type": "string",
2293
+ "minLength": 1
2294
+ },
2295
+ "version": {
2296
+ "type": "string",
2297
+ "minLength": 1
2298
+ },
2299
+ "artifactRef": {
2300
+ "type": "string",
2301
+ "minLength": 1
2302
+ }
2303
+ },
2304
+ "required": [
2305
+ "tool",
2306
+ "artifactRef"
2307
+ ],
2308
+ "additionalProperties": false
2309
+ },
2310
+ "context": {
2311
+ "type": "object",
2312
+ "properties": {
2313
+ "subject": {
2314
+ "type": "object",
2315
+ "properties": {
2316
+ "repositoryId": {
2317
+ "type": "string",
2318
+ "minLength": 1
2319
+ },
2320
+ "prHeadSha": {
2321
+ "type": "string",
2322
+ "minLength": 1
2323
+ },
2324
+ "testedCommitSha": {
2325
+ "type": "string",
2326
+ "minLength": 1
2327
+ },
2328
+ "testedCommitParents": {
2329
+ "type": "array",
2330
+ "items": {
2331
+ "type": "string",
2332
+ "minLength": 1
2333
+ }
2334
+ },
2335
+ "sourceTreeHash": {
2336
+ "type": "string",
2337
+ "pattern": "^[a-f0-9]{64}$"
2338
+ },
2339
+ "dirty": {
2340
+ "type": "boolean"
2341
+ },
2342
+ "baseSha": {
2343
+ "type": "string",
2344
+ "minLength": 1
2345
+ },
2346
+ "diffBaseSha": {
2347
+ "type": "string",
2348
+ "minLength": 1
2349
+ }
2350
+ },
2351
+ "required": [
2352
+ "testedCommitSha",
2353
+ "sourceTreeHash",
2354
+ "dirty"
2355
+ ],
2356
+ "additionalProperties": false
2357
+ },
2358
+ "manifestRef": {
2359
+ "type": "string",
2360
+ "minLength": 1
2361
+ },
2362
+ "protectedPolicySha": {
2363
+ "type": "string",
2364
+ "minLength": 1
2365
+ },
2366
+ "effectivePolicyHash": {
2367
+ "type": "string",
2368
+ "pattern": "^[a-f0-9]{64}$"
2369
+ },
2370
+ "contractHash": {
2371
+ "type": "string",
2372
+ "pattern": "^[a-f0-9]{64}$"
2373
+ },
2374
+ "generatedAt": {
2375
+ "type": "string",
2376
+ "format": "date-time",
2377
+ "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$"
2378
+ },
2379
+ "collectedAt": {
2380
+ "type": "string",
2381
+ "format": "date-time",
2382
+ "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$"
2383
+ }
2384
+ },
2385
+ "required": [
2386
+ "effectivePolicyHash",
2387
+ "collectedAt"
2388
+ ],
2389
+ "additionalProperties": false
2390
+ },
2391
+ "provenance": {
2392
+ "type": "object",
2393
+ "properties": {
2394
+ "artifactIntegrity": {
2395
+ "type": "string",
2396
+ "enum": [
2397
+ "pass",
2398
+ "fail",
2399
+ "unknown",
2400
+ "not_applicable"
2401
+ ]
2402
+ },
2403
+ "producerTrust": {
2404
+ "type": "string",
2405
+ "enum": [
2406
+ "pass",
2407
+ "fail",
2408
+ "unknown",
2409
+ "not_applicable"
2410
+ ]
2411
+ },
2412
+ "subjectMatch": {
2413
+ "type": "string",
2414
+ "enum": [
2415
+ "pass",
2416
+ "fail",
2417
+ "unknown",
2418
+ "not_applicable"
2419
+ ]
2420
+ },
2421
+ "reasons": {
2422
+ "type": "array",
2423
+ "items": {
2424
+ "type": "string",
2425
+ "minLength": 1
2426
+ }
2427
+ }
2428
+ },
2429
+ "required": [
2430
+ "artifactIntegrity",
2431
+ "producerTrust",
2432
+ "subjectMatch",
2433
+ "reasons"
2434
+ ],
2435
+ "additionalProperties": false
2436
+ },
2437
+ "subjectRefs": {
2438
+ "type": "array",
2439
+ "items": {
2440
+ "type": "string",
2441
+ "minLength": 1
2442
+ }
2443
+ },
2444
+ "kind": {
2445
+ "type": "string",
2446
+ "const": "formal_model"
2447
+ },
2448
+ "payload": {
2449
+ "anyOf": [
2450
+ {
2451
+ "type": "object",
2452
+ "properties": {
2453
+ "schemaVersion": {
2454
+ "type": "number",
2455
+ "const": 1
2456
+ },
2457
+ "modelId": {
2458
+ "type": "string",
2459
+ "minLength": 1
2460
+ },
2461
+ "identity": {
2462
+ "type": "object",
2463
+ "properties": {
2464
+ "modelHash": {
2465
+ "type": "string",
2466
+ "pattern": "^[a-f0-9]{64}$"
2467
+ },
2468
+ "configHash": {
2469
+ "type": "string",
2470
+ "pattern": "^[a-f0-9]{64}$"
2471
+ },
2472
+ "commandHash": {
2473
+ "type": "string",
2474
+ "pattern": "^[a-f0-9]{64}$"
2475
+ },
2476
+ "driverHash": {
2477
+ "type": "string",
2478
+ "pattern": "^[a-f0-9]{64}$"
2479
+ },
2480
+ "implementationHash": {
2481
+ "type": "string",
2482
+ "pattern": "^[a-f0-9]{64}$"
2483
+ },
2484
+ "traceHash": {
2485
+ "type": "string",
2486
+ "pattern": "^[a-f0-9]{64}$"
2487
+ }
2488
+ },
2489
+ "required": [
2490
+ "modelHash",
2491
+ "configHash",
2492
+ "commandHash"
2493
+ ],
2494
+ "additionalProperties": false
2495
+ },
2496
+ "stages": {
2497
+ "maxItems": 5,
2498
+ "type": "array",
2499
+ "items": {
2500
+ "type": "object",
2501
+ "properties": {
2502
+ "stage": {
2503
+ "type": "string",
2504
+ "enum": [
2505
+ "parse",
2506
+ "typecheck",
2507
+ "test",
2508
+ "run",
2509
+ "verify"
2510
+ ]
2511
+ },
2512
+ "status": {
2513
+ "type": "string",
2514
+ "enum": [
2515
+ "pass",
2516
+ "fail",
2517
+ "unknown"
2518
+ ]
2519
+ },
2520
+ "complete": {
2521
+ "type": "boolean"
2522
+ },
2523
+ "exitCode": {
2524
+ "anyOf": [
2525
+ {
2526
+ "type": "integer",
2527
+ "minimum": -9007199254740991,
2528
+ "maximum": 9007199254740991
2529
+ },
2530
+ {
2531
+ "type": "null"
2532
+ }
2533
+ ]
2534
+ },
2535
+ "toolVersion": {
2536
+ "type": "string",
2537
+ "minLength": 1
2538
+ },
2539
+ "backend": {
2540
+ "type": "string",
2541
+ "enum": [
2542
+ "quint",
2543
+ "typescript",
2544
+ "rust",
2545
+ "apalache",
2546
+ "tlc"
2547
+ ]
2548
+ },
2549
+ "method": {
2550
+ "type": "string",
2551
+ "enum": [
2552
+ "parse",
2553
+ "typecheck",
2554
+ "spec_test",
2555
+ "simulation",
2556
+ "bounded_model_check",
2557
+ "finite_state_check"
2558
+ ]
2559
+ },
2560
+ "properties": {
2561
+ "maxItems": 10000,
2562
+ "type": "array",
2563
+ "items": {
2564
+ "type": "string",
2565
+ "minLength": 1
2566
+ }
2567
+ },
2568
+ "maxSteps": {
2569
+ "type": "integer",
2570
+ "minimum": 0,
2571
+ "maximum": 9007199254740991
2572
+ },
2573
+ "maxSamples": {
2574
+ "type": "integer",
2575
+ "minimum": 0,
2576
+ "maximum": 9007199254740991
2577
+ },
2578
+ "seed": {
2579
+ "type": "string",
2580
+ "minLength": 1
2581
+ },
2582
+ "traceSeed": {
2583
+ "type": "string",
2584
+ "minLength": 1
2585
+ },
2586
+ "backendVersion": {
2587
+ "type": "string",
2588
+ "minLength": 1
2589
+ },
2590
+ "diagnostics": {
2591
+ "maxItems": 1000,
2592
+ "type": "array",
2593
+ "items": {
2594
+ "type": "string",
2595
+ "minLength": 1
2596
+ }
2597
+ },
2598
+ "stdoutHash": {
2599
+ "type": "string",
2600
+ "pattern": "^[a-f0-9]{64}$"
2601
+ },
2602
+ "stderrHash": {
2603
+ "type": "string",
2604
+ "pattern": "^[a-f0-9]{64}$"
2605
+ },
2606
+ "artifacts": {
2607
+ "maxItems": 1000,
2608
+ "type": "array",
2609
+ "items": {
2610
+ "type": "object",
2611
+ "properties": {
2612
+ "ref": {
2613
+ "type": "string",
2614
+ "minLength": 1
2615
+ },
2616
+ "sha256": {
2617
+ "type": "string",
2618
+ "pattern": "^[a-f0-9]{64}$"
2619
+ }
2620
+ },
2621
+ "required": [
2622
+ "ref",
2623
+ "sha256"
2624
+ ],
2625
+ "additionalProperties": false
2626
+ }
2627
+ }
2628
+ },
2629
+ "required": [
2630
+ "stage",
2631
+ "status",
2632
+ "complete",
2633
+ "exitCode",
2634
+ "toolVersion",
2635
+ "backend",
2636
+ "method",
2637
+ "properties",
2638
+ "diagnostics"
2639
+ ],
2640
+ "additionalProperties": false
2641
+ }
2642
+ }
2643
+ },
2644
+ "required": [
2645
+ "schemaVersion",
2646
+ "modelId",
2647
+ "identity",
2648
+ "stages"
2649
+ ],
2650
+ "additionalProperties": false
2651
+ },
2652
+ {
2653
+ "type": "object",
2654
+ "properties": {
2655
+ "status": {
2656
+ "type": "string",
2657
+ "const": "unknown"
2658
+ },
2659
+ "reason": {
2660
+ "type": "string",
2661
+ "minLength": 1
2662
+ }
2663
+ },
2664
+ "required": [
2665
+ "status",
2666
+ "reason"
2667
+ ],
2668
+ "additionalProperties": false
2669
+ }
2670
+ ]
2671
+ }
2672
+ },
2673
+ "required": [
2674
+ "schemaVersion",
2675
+ "id",
2676
+ "source",
2677
+ "context",
2678
+ "provenance",
2679
+ "subjectRefs",
2680
+ "kind",
2681
+ "payload"
2682
+ ],
2683
+ "additionalProperties": false
2684
+ },
2685
+ {
2686
+ "type": "object",
2687
+ "properties": {
2688
+ "schemaVersion": {
2689
+ "type": "number",
2690
+ "const": 1
2691
+ },
2692
+ "id": {
2693
+ "type": "string",
2694
+ "minLength": 1
2695
+ },
2696
+ "source": {
2697
+ "type": "object",
2698
+ "properties": {
2699
+ "tool": {
2700
+ "type": "string",
2701
+ "minLength": 1
2702
+ },
2703
+ "version": {
2704
+ "type": "string",
2705
+ "minLength": 1
2706
+ },
2707
+ "artifactRef": {
2708
+ "type": "string",
2709
+ "minLength": 1
2710
+ }
2711
+ },
2712
+ "required": [
2713
+ "tool",
2714
+ "artifactRef"
2715
+ ],
2716
+ "additionalProperties": false
2717
+ },
2718
+ "context": {
2719
+ "type": "object",
2720
+ "properties": {
2721
+ "subject": {
2722
+ "type": "object",
2723
+ "properties": {
2724
+ "repositoryId": {
2725
+ "type": "string",
2726
+ "minLength": 1
2727
+ },
2728
+ "prHeadSha": {
2729
+ "type": "string",
2730
+ "minLength": 1
2731
+ },
2732
+ "testedCommitSha": {
2733
+ "type": "string",
2734
+ "minLength": 1
2735
+ },
2736
+ "testedCommitParents": {
2737
+ "type": "array",
2738
+ "items": {
2739
+ "type": "string",
2740
+ "minLength": 1
2741
+ }
2742
+ },
2743
+ "sourceTreeHash": {
2744
+ "type": "string",
2745
+ "pattern": "^[a-f0-9]{64}$"
2746
+ },
2747
+ "dirty": {
2748
+ "type": "boolean"
2749
+ },
2750
+ "baseSha": {
2751
+ "type": "string",
2752
+ "minLength": 1
2753
+ },
2754
+ "diffBaseSha": {
2755
+ "type": "string",
2756
+ "minLength": 1
2757
+ }
2758
+ },
2759
+ "required": [
2760
+ "testedCommitSha",
2761
+ "sourceTreeHash",
2762
+ "dirty"
2763
+ ],
2764
+ "additionalProperties": false
2765
+ },
2766
+ "manifestRef": {
2767
+ "type": "string",
2768
+ "minLength": 1
2769
+ },
2770
+ "protectedPolicySha": {
2771
+ "type": "string",
2772
+ "minLength": 1
2773
+ },
2774
+ "effectivePolicyHash": {
2775
+ "type": "string",
2776
+ "pattern": "^[a-f0-9]{64}$"
2777
+ },
2778
+ "contractHash": {
2779
+ "type": "string",
2780
+ "pattern": "^[a-f0-9]{64}$"
2781
+ },
2782
+ "generatedAt": {
2783
+ "type": "string",
2784
+ "format": "date-time",
2785
+ "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$"
2786
+ },
2787
+ "collectedAt": {
2788
+ "type": "string",
2789
+ "format": "date-time",
2790
+ "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$"
2791
+ }
2792
+ },
2793
+ "required": [
2794
+ "effectivePolicyHash",
2795
+ "collectedAt"
2796
+ ],
2797
+ "additionalProperties": false
2798
+ },
2799
+ "provenance": {
2800
+ "type": "object",
2801
+ "properties": {
2802
+ "artifactIntegrity": {
2803
+ "type": "string",
2804
+ "enum": [
2805
+ "pass",
2806
+ "fail",
2807
+ "unknown",
2808
+ "not_applicable"
2809
+ ]
2810
+ },
2811
+ "producerTrust": {
2812
+ "type": "string",
2813
+ "enum": [
2814
+ "pass",
2815
+ "fail",
2816
+ "unknown",
2817
+ "not_applicable"
2818
+ ]
2819
+ },
2820
+ "subjectMatch": {
2821
+ "type": "string",
2822
+ "enum": [
2823
+ "pass",
2824
+ "fail",
2825
+ "unknown",
2826
+ "not_applicable"
2827
+ ]
2828
+ },
2829
+ "reasons": {
2830
+ "type": "array",
2831
+ "items": {
2832
+ "type": "string",
2833
+ "minLength": 1
2834
+ }
2835
+ }
2836
+ },
2837
+ "required": [
2838
+ "artifactIntegrity",
2839
+ "producerTrust",
2840
+ "subjectMatch",
2841
+ "reasons"
2842
+ ],
2843
+ "additionalProperties": false
2844
+ },
2845
+ "subjectRefs": {
2846
+ "type": "array",
2847
+ "items": {
2848
+ "type": "string",
2849
+ "minLength": 1
2850
+ }
2851
+ },
2852
+ "kind": {
2853
+ "type": "string",
2854
+ "const": "model_conformance"
2855
+ },
2856
+ "payload": {
2857
+ "anyOf": [
2858
+ {
2859
+ "type": "object",
2860
+ "properties": {
2861
+ "schemaVersion": {
2862
+ "type": "number",
2863
+ "const": 1
2864
+ },
2865
+ "modelId": {
2866
+ "type": "string",
2867
+ "minLength": 1
2868
+ },
2869
+ "identity": {
2870
+ "type": "object",
2871
+ "properties": {
2872
+ "modelHash": {
2873
+ "type": "string",
2874
+ "pattern": "^[a-f0-9]{64}$"
2875
+ },
2876
+ "configHash": {
2877
+ "type": "string",
2878
+ "pattern": "^[a-f0-9]{64}$"
2879
+ },
2880
+ "commandHash": {
2881
+ "type": "string",
2882
+ "pattern": "^[a-f0-9]{64}$"
2883
+ },
2884
+ "driverHash": {
2885
+ "type": "string",
2886
+ "pattern": "^[a-f0-9]{64}$"
2887
+ },
2888
+ "implementationHash": {
2889
+ "type": "string",
2890
+ "pattern": "^[a-f0-9]{64}$"
2891
+ },
2892
+ "traceHash": {
2893
+ "type": "string",
2894
+ "pattern": "^[a-f0-9]{64}$"
2895
+ }
2896
+ },
2897
+ "required": [
2898
+ "modelHash",
2899
+ "configHash",
2900
+ "commandHash"
2901
+ ],
2902
+ "additionalProperties": false
2903
+ },
2904
+ "runner": {
2905
+ "type": "string",
2906
+ "minLength": 1
2907
+ },
2908
+ "observation": {
2909
+ "type": "string",
2910
+ "enum": [
2911
+ "module-functions",
2912
+ "unverified"
2913
+ ]
2914
+ },
2915
+ "complete": {
2916
+ "type": "boolean"
2917
+ },
2918
+ "diagnostics": {
2919
+ "maxItems": 1000,
2920
+ "type": "array",
2921
+ "items": {
2922
+ "type": "string",
2923
+ "minLength": 1
2924
+ }
2925
+ },
2926
+ "traces": {
2927
+ "maxItems": 10000,
2928
+ "type": "array",
2929
+ "items": {
2930
+ "type": "object",
2931
+ "properties": {
2932
+ "id": {
2933
+ "type": "string",
2934
+ "minLength": 1
2935
+ },
2936
+ "complete": {
2937
+ "type": "boolean"
2938
+ },
2939
+ "steps": {
2940
+ "maxItems": 10001,
2941
+ "type": "array",
2942
+ "items": {
2943
+ "type": "object",
2944
+ "properties": {
2945
+ "index": {
2946
+ "type": "integer",
2947
+ "minimum": 0,
2948
+ "maximum": 9007199254740991
2949
+ },
2950
+ "action": {
2951
+ "type": "string",
2952
+ "minLength": 1
2953
+ },
2954
+ "status": {
2955
+ "type": "string",
2956
+ "enum": [
2957
+ "pass",
2958
+ "fail",
2959
+ "unknown"
2960
+ ]
2961
+ },
2962
+ "parameters": {
2963
+ "$ref": "#/$defs/__schema0"
2964
+ },
2965
+ "expected": {
2966
+ "$ref": "#/$defs/__schema1"
2967
+ },
2968
+ "actual": {
2969
+ "$ref": "#/$defs/__schema2"
2970
+ },
2971
+ "comparisonCount": {
2972
+ "type": "integer",
2973
+ "minimum": 0,
2974
+ "maximum": 1
2975
+ },
2976
+ "implementationCalls": {
2977
+ "type": "integer",
2978
+ "minimum": 0,
2979
+ "maximum": 9007199254740991
2980
+ },
2981
+ "diagnostic": {
2982
+ "type": "string",
2983
+ "minLength": 1
2984
+ }
2985
+ },
2986
+ "required": [
2987
+ "index",
2988
+ "action",
2989
+ "status",
2990
+ "expected",
2991
+ "comparisonCount",
2992
+ "implementationCalls"
2993
+ ],
2994
+ "additionalProperties": false
2995
+ }
2996
+ }
2997
+ },
2998
+ "required": [
2999
+ "id",
3000
+ "complete",
3001
+ "steps"
3002
+ ],
3003
+ "additionalProperties": false
3004
+ }
3005
+ },
3006
+ "canary": {
3007
+ "type": "object",
3008
+ "properties": {
3009
+ "faultId": {
3010
+ "type": "string",
3011
+ "minLength": 1
3012
+ },
3013
+ "implementationHash": {
3014
+ "type": "string",
3015
+ "pattern": "^[a-f0-9]{64}$"
3016
+ },
3017
+ "originalImplementationHash": {
3018
+ "type": "string",
3019
+ "pattern": "^[a-f0-9]{64}$"
3020
+ },
3021
+ "driverHash": {
3022
+ "type": "string",
3023
+ "pattern": "^[a-f0-9]{64}$"
3024
+ },
3025
+ "traceHash": {
3026
+ "type": "string",
3027
+ "pattern": "^[a-f0-9]{64}$"
3028
+ },
3029
+ "observedCalls": {
3030
+ "type": "integer",
3031
+ "minimum": 0,
3032
+ "maximum": 9007199254740991
3033
+ },
3034
+ "comparedSteps": {
3035
+ "type": "integer",
3036
+ "minimum": 0,
3037
+ "maximum": 9007199254740991
3038
+ },
3039
+ "detectedMismatches": {
3040
+ "type": "integer",
3041
+ "minimum": 0,
3042
+ "maximum": 9007199254740991
3043
+ },
3044
+ "failure": {
3045
+ "type": "object",
3046
+ "properties": {
3047
+ "traceId": {
3048
+ "type": "string",
3049
+ "minLength": 1
3050
+ },
3051
+ "index": {
3052
+ "type": "integer",
3053
+ "minimum": 0,
3054
+ "maximum": 9007199254740991
3055
+ },
3056
+ "action": {
3057
+ "type": "string",
3058
+ "minLength": 1
3059
+ },
3060
+ "implementationCalls": {
3061
+ "type": "integer",
3062
+ "minimum": 0,
3063
+ "maximum": 9007199254740991
3064
+ },
3065
+ "expected": {
3066
+ "$ref": "#/$defs/__schema3"
3067
+ },
3068
+ "actual": {
3069
+ "$ref": "#/$defs/__schema4"
3070
+ }
3071
+ },
3072
+ "required": [
3073
+ "traceId",
3074
+ "index",
3075
+ "action",
3076
+ "implementationCalls",
3077
+ "expected",
3078
+ "actual"
3079
+ ],
3080
+ "additionalProperties": false
3081
+ }
3082
+ },
3083
+ "required": [
3084
+ "faultId",
3085
+ "implementationHash",
3086
+ "originalImplementationHash",
3087
+ "driverHash",
3088
+ "traceHash",
3089
+ "observedCalls",
3090
+ "comparedSteps",
3091
+ "detectedMismatches"
3092
+ ],
3093
+ "additionalProperties": false
3094
+ }
3095
+ },
3096
+ "required": [
3097
+ "schemaVersion",
3098
+ "modelId",
3099
+ "identity",
3100
+ "runner",
3101
+ "observation",
3102
+ "complete",
3103
+ "diagnostics",
3104
+ "traces"
3105
+ ],
3106
+ "additionalProperties": false
3107
+ },
3108
+ {
3109
+ "type": "object",
3110
+ "properties": {
3111
+ "status": {
3112
+ "type": "string",
3113
+ "const": "unknown"
3114
+ },
3115
+ "reason": {
3116
+ "type": "string",
3117
+ "minLength": 1
3118
+ }
3119
+ },
3120
+ "required": [
3121
+ "status",
3122
+ "reason"
3123
+ ],
3124
+ "additionalProperties": false
3125
+ }
3126
+ ]
3127
+ }
3128
+ },
3129
+ "required": [
3130
+ "schemaVersion",
3131
+ "id",
3132
+ "source",
3133
+ "context",
3134
+ "provenance",
3135
+ "subjectRefs",
3136
+ "kind",
3137
+ "payload"
3138
+ ],
3139
+ "additionalProperties": false
3140
+ },
3141
+ {
3142
+ "type": "object",
3143
+ "properties": {
3144
+ "schemaVersion": {
3145
+ "type": "number",
3146
+ "const": 1
3147
+ },
3148
+ "id": {
3149
+ "type": "string",
3150
+ "minLength": 1
3151
+ },
3152
+ "source": {
3153
+ "type": "object",
3154
+ "properties": {
3155
+ "tool": {
3156
+ "type": "string",
3157
+ "minLength": 1
3158
+ },
3159
+ "version": {
3160
+ "type": "string",
3161
+ "minLength": 1
3162
+ },
3163
+ "artifactRef": {
3164
+ "type": "string",
3165
+ "minLength": 1
3166
+ }
3167
+ },
3168
+ "required": [
3169
+ "tool",
3170
+ "artifactRef"
3171
+ ],
3172
+ "additionalProperties": false
3173
+ },
3174
+ "context": {
3175
+ "type": "object",
3176
+ "properties": {
3177
+ "subject": {
3178
+ "type": "object",
3179
+ "properties": {
3180
+ "repositoryId": {
3181
+ "type": "string",
3182
+ "minLength": 1
3183
+ },
3184
+ "prHeadSha": {
3185
+ "type": "string",
3186
+ "minLength": 1
3187
+ },
3188
+ "testedCommitSha": {
3189
+ "type": "string",
3190
+ "minLength": 1
3191
+ },
3192
+ "testedCommitParents": {
3193
+ "type": "array",
3194
+ "items": {
3195
+ "type": "string",
3196
+ "minLength": 1
3197
+ }
3198
+ },
3199
+ "sourceTreeHash": {
3200
+ "type": "string",
3201
+ "pattern": "^[a-f0-9]{64}$"
3202
+ },
3203
+ "dirty": {
3204
+ "type": "boolean"
3205
+ },
3206
+ "baseSha": {
3207
+ "type": "string",
3208
+ "minLength": 1
3209
+ },
3210
+ "diffBaseSha": {
3211
+ "type": "string",
3212
+ "minLength": 1
3213
+ }
3214
+ },
3215
+ "required": [
3216
+ "testedCommitSha",
3217
+ "sourceTreeHash",
3218
+ "dirty"
3219
+ ],
3220
+ "additionalProperties": false
3221
+ },
3222
+ "manifestRef": {
3223
+ "type": "string",
3224
+ "minLength": 1
3225
+ },
3226
+ "protectedPolicySha": {
3227
+ "type": "string",
3228
+ "minLength": 1
3229
+ },
3230
+ "effectivePolicyHash": {
3231
+ "type": "string",
3232
+ "pattern": "^[a-f0-9]{64}$"
3233
+ },
3234
+ "contractHash": {
3235
+ "type": "string",
3236
+ "pattern": "^[a-f0-9]{64}$"
3237
+ },
3238
+ "generatedAt": {
3239
+ "type": "string",
3240
+ "format": "date-time",
3241
+ "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$"
3242
+ },
3243
+ "collectedAt": {
3244
+ "type": "string",
3245
+ "format": "date-time",
3246
+ "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$"
3247
+ }
3248
+ },
3249
+ "required": [
3250
+ "effectivePolicyHash",
3251
+ "collectedAt"
3252
+ ],
3253
+ "additionalProperties": false
3254
+ },
3255
+ "provenance": {
3256
+ "type": "object",
3257
+ "properties": {
3258
+ "artifactIntegrity": {
3259
+ "type": "string",
3260
+ "enum": [
3261
+ "pass",
3262
+ "fail",
3263
+ "unknown",
3264
+ "not_applicable"
3265
+ ]
3266
+ },
3267
+ "producerTrust": {
3268
+ "type": "string",
3269
+ "enum": [
3270
+ "pass",
3271
+ "fail",
3272
+ "unknown",
3273
+ "not_applicable"
3274
+ ]
3275
+ },
3276
+ "subjectMatch": {
3277
+ "type": "string",
3278
+ "enum": [
3279
+ "pass",
3280
+ "fail",
3281
+ "unknown",
3282
+ "not_applicable"
3283
+ ]
3284
+ },
3285
+ "reasons": {
3286
+ "type": "array",
3287
+ "items": {
3288
+ "type": "string",
3289
+ "minLength": 1
3290
+ }
3291
+ }
3292
+ },
3293
+ "required": [
3294
+ "artifactIntegrity",
3295
+ "producerTrust",
3296
+ "subjectMatch",
3297
+ "reasons"
3298
+ ],
3299
+ "additionalProperties": false
3300
+ },
3301
+ "subjectRefs": {
3302
+ "type": "array",
3303
+ "items": {
3304
+ "type": "string",
3305
+ "minLength": 1
3306
+ }
3307
+ },
3308
+ "kind": {
3309
+ "type": "string",
3310
+ "const": "trace"
3311
+ },
3312
+ "payload": {
3313
+ "anyOf": [
3314
+ {
3315
+ "type": "object",
3316
+ "properties": {
3317
+ "schemaVersion": {
3318
+ "type": "number",
3319
+ "const": 1
3320
+ },
3321
+ "modelId": {
3322
+ "type": "string",
3323
+ "minLength": 1
3324
+ },
3325
+ "identity": {
3326
+ "type": "object",
3327
+ "properties": {
3328
+ "modelHash": {
3329
+ "type": "string",
3330
+ "pattern": "^[a-f0-9]{64}$"
3331
+ },
3332
+ "configHash": {
3333
+ "type": "string",
3334
+ "pattern": "^[a-f0-9]{64}$"
3335
+ },
3336
+ "commandHash": {
3337
+ "type": "string",
3338
+ "pattern": "^[a-f0-9]{64}$"
3339
+ },
3340
+ "driverHash": {
3341
+ "type": "string",
3342
+ "pattern": "^[a-f0-9]{64}$"
3343
+ },
3344
+ "implementationHash": {
3345
+ "type": "string",
3346
+ "pattern": "^[a-f0-9]{64}$"
3347
+ },
3348
+ "traceHash": {
3349
+ "type": "string",
3350
+ "pattern": "^[a-f0-9]{64}$"
3351
+ }
3352
+ },
3353
+ "required": [
3354
+ "modelHash",
3355
+ "configHash",
3356
+ "commandHash"
3357
+ ],
3358
+ "additionalProperties": false
3359
+ },
3360
+ "toolVersion": {
3361
+ "type": "string",
3362
+ "minLength": 1
3363
+ },
3364
+ "backend": {
3365
+ "type": "string",
3366
+ "enum": [
3367
+ "typescript",
3368
+ "rust"
3369
+ ]
3370
+ },
3371
+ "maxSteps": {
3372
+ "type": "integer",
3373
+ "minimum": 1,
3374
+ "maximum": 9007199254740991
3375
+ },
3376
+ "maxSamples": {
3377
+ "type": "integer",
3378
+ "minimum": 1,
3379
+ "maximum": 9007199254740991
3380
+ },
3381
+ "seed": {
3382
+ "type": "string",
3383
+ "minLength": 1
3384
+ },
3385
+ "traces": {
3386
+ "maxItems": 10000,
3387
+ "type": "array",
3388
+ "items": {
3389
+ "type": "object",
3390
+ "properties": {
3391
+ "ref": {
3392
+ "type": "string",
3393
+ "minLength": 1
3394
+ },
3395
+ "sha256": {
3396
+ "type": "string",
3397
+ "pattern": "^[a-f0-9]{64}$"
3398
+ }
3399
+ },
3400
+ "required": [
3401
+ "ref",
3402
+ "sha256"
3403
+ ],
3404
+ "additionalProperties": false
3405
+ }
3406
+ }
3407
+ },
3408
+ "required": [
3409
+ "schemaVersion",
3410
+ "modelId",
3411
+ "identity",
3412
+ "toolVersion",
3413
+ "backend",
3414
+ "maxSteps",
3415
+ "maxSamples",
3416
+ "seed",
3417
+ "traces"
3418
+ ],
3419
+ "additionalProperties": false
3420
+ },
3421
+ {
3422
+ "type": "object",
3423
+ "properties": {
3424
+ "status": {
3425
+ "type": "string",
3426
+ "const": "unknown"
3427
+ },
3428
+ "reason": {
3429
+ "type": "string",
3430
+ "minLength": 1
3431
+ }
3432
+ },
3433
+ "required": [
3434
+ "status",
3435
+ "reason"
3436
+ ],
3437
+ "additionalProperties": false
3438
+ }
3439
+ ]
3440
+ }
3441
+ },
3442
+ "required": [
3443
+ "schemaVersion",
3444
+ "id",
3445
+ "source",
3446
+ "context",
3447
+ "provenance",
3448
+ "subjectRefs",
3449
+ "kind",
3450
+ "payload"
3451
+ ],
3452
+ "additionalProperties": false
3453
+ }
3454
+ ],
3455
+ "$defs": {
3456
+ "__schema0": {
3457
+ "anyOf": [
3458
+ {
3459
+ "type": "string"
3460
+ },
3461
+ {
3462
+ "type": "number"
3463
+ },
3464
+ {
3465
+ "type": "boolean"
3466
+ },
3467
+ {
3468
+ "type": "null"
3469
+ },
3470
+ {
3471
+ "type": "array",
3472
+ "items": {
3473
+ "$ref": "#/$defs/__schema0"
3474
+ }
3475
+ },
3476
+ {
3477
+ "type": "object",
3478
+ "propertyNames": {
3479
+ "type": "string"
3480
+ },
3481
+ "additionalProperties": {
3482
+ "$ref": "#/$defs/__schema0"
3483
+ }
3484
+ }
3485
+ ]
3486
+ },
3487
+ "__schema1": {
3488
+ "anyOf": [
3489
+ {
3490
+ "type": "string"
3491
+ },
3492
+ {
3493
+ "type": "number"
3494
+ },
3495
+ {
3496
+ "type": "boolean"
3497
+ },
3498
+ {
3499
+ "type": "null"
3500
+ },
3501
+ {
3502
+ "type": "array",
3503
+ "items": {
3504
+ "$ref": "#/$defs/__schema1"
3505
+ }
3506
+ },
3507
+ {
3508
+ "type": "object",
3509
+ "propertyNames": {
3510
+ "type": "string"
3511
+ },
3512
+ "additionalProperties": {
3513
+ "$ref": "#/$defs/__schema1"
3514
+ }
3515
+ }
3516
+ ]
3517
+ },
3518
+ "__schema2": {
3519
+ "anyOf": [
3520
+ {
3521
+ "type": "string"
3522
+ },
3523
+ {
3524
+ "type": "number"
3525
+ },
3526
+ {
3527
+ "type": "boolean"
3528
+ },
3529
+ {
3530
+ "type": "null"
3531
+ },
3532
+ {
3533
+ "type": "array",
3534
+ "items": {
3535
+ "$ref": "#/$defs/__schema2"
3536
+ }
3537
+ },
3538
+ {
3539
+ "type": "object",
3540
+ "propertyNames": {
3541
+ "type": "string"
3542
+ },
3543
+ "additionalProperties": {
3544
+ "$ref": "#/$defs/__schema2"
3545
+ }
3546
+ }
3547
+ ]
3548
+ },
3549
+ "__schema3": {
3550
+ "anyOf": [
3551
+ {
3552
+ "type": "string"
3553
+ },
3554
+ {
3555
+ "type": "number"
3556
+ },
3557
+ {
3558
+ "type": "boolean"
3559
+ },
3560
+ {
3561
+ "type": "null"
3562
+ },
3563
+ {
3564
+ "type": "array",
3565
+ "items": {
3566
+ "$ref": "#/$defs/__schema3"
3567
+ }
3568
+ },
3569
+ {
3570
+ "type": "object",
3571
+ "propertyNames": {
3572
+ "type": "string"
3573
+ },
3574
+ "additionalProperties": {
3575
+ "$ref": "#/$defs/__schema3"
3576
+ }
3577
+ }
3578
+ ]
3579
+ },
3580
+ "__schema4": {
3581
+ "anyOf": [
3582
+ {
3583
+ "type": "string"
3584
+ },
3585
+ {
3586
+ "type": "number"
3587
+ },
3588
+ {
3589
+ "type": "boolean"
3590
+ },
3591
+ {
3592
+ "type": "null"
3593
+ },
3594
+ {
3595
+ "type": "array",
3596
+ "items": {
3597
+ "$ref": "#/$defs/__schema4"
3598
+ }
3599
+ },
3600
+ {
3601
+ "type": "object",
3602
+ "propertyNames": {
3603
+ "type": "string"
3604
+ },
3605
+ "additionalProperties": {
3606
+ "$ref": "#/$defs/__schema4"
3607
+ }
3608
+ }
3609
+ ]
3610
+ }
3611
+ }
3612
+ }