@bluefly/openstandardagents 0.3.1 → 0.3.3

package/spec/v0.3.3/protocols/identity-runtime.schema.json

@@ -0,0 +1,482 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "https://openstandardagents.org/schemas/v0.3.0/identity.json",
+  "title": "OSSA Agent Identity & Authentication Schemas",
+  "description": "JSON Schema definitions for agent identity, authentication, and security context following OSSA v0.3.0 patterns",
+  "definitions": {
+    "AgentIdentity": {
+      "type": "object",
+      "description": "Complete identity information for an OSSA agent instance",
+      "required": [
+        "agent_id",
+        "instance_id",
+        "version",
+        "status"
+      ],
+      "properties": {
+        "agent_id": {
+          "type": "string",
+          "description": "Unique identifier for the agent definition (from manifest.metadata.name)",
+          "pattern": "^[a-z0-9]([-a-z0-9]*[a-z0-9])?$",
+          "minLength": 1,
+          "maxLength": 63
+        },
+        "instance_id": {
+          "type": "string",
+          "format": "uuid",
+          "description": "Unique identifier for this specific agent instance"
+        },
+        "version": {
+          "type": "string",
+          "description": "OSSA API version (e.g., ossa/v0.3.0)",
+          "pattern": "^ossa/v(0\\.3\\.[0-9]+|1)(\\.[0-9]+)?(-[a-zA-Z0-9]+)?$"
+        },
+        "kind": {
+          "type": "string",
+          "enum": ["Agent", "Task", "Workflow"],
+          "description": "OSSA resource kind"
+        },
+        "status": {
+          "type": "string",
+          "enum": ["active", "inactive", "suspended", "terminated"],
+          "description": "Current operational status of the agent instance"
+        },
+        "tenant_id": {
+          "type": "string",
+          "description": "Multi-tenant environment identifier"
+        },
+        "user_id": {
+          "type": "string",
+          "description": "Identifier of the user who owns or initiated this agent"
+        },
+        "parent_instance_id": {
+          "type": "string",
+          "format": "uuid",
+          "description": "Parent agent instance ID for multi-agent scenarios"
+        },
+        "workflow_id": {
+          "type": "string",
+          "format": "uuid",
+          "description": "Associated workflow execution ID"
+        },
+        "trace_id": {
+          "type": "string",
+          "pattern": "^[a-f0-9]{32}$",
+          "description": "W3C Trace ID for distributed tracing"
+        },
+        "span_id": {
+          "type": "string",
+          "pattern": "^[a-f0-9]{16}$",
+          "description": "W3C Span ID for distributed tracing"
+        },
+        "created_at": {
+          "type": "string",
+          "format": "date-time",
+          "description": "ISO 8601 timestamp when the agent instance was created"
+        },
+        "updated_at": {
+          "type": "string",
+          "format": "date-time",
+          "description": "ISO 8601 timestamp when the agent instance was last updated"
+        },
+        "metadata": {
+          "type": "object",
+          "description": "Additional metadata from the agent manifest",
+          "properties": {
+            "labels": {
+              "type": "object",
+              "additionalProperties": {
+                "type": "string"
+              },
+              "description": "Key-value labels for categorization"
+            },
+            "annotations": {
+              "type": "object",
+              "additionalProperties": {
+                "type": "string"
+              },
+              "description": "Key-value annotations for additional information"
+            }
+          }
+        }
+      },
+      "additionalProperties": false
+    },
+    "AuthenticationRequest": {
+      "type": "object",
+      "description": "Request payload for agent authentication",
+      "required": [
+        "agent_id",
+        "credential"
+      ],
+      "properties": {
+        "agent_id": {
+          "type": "string",
+          "description": "Agent identifier from the manifest",
+          "pattern": "^[a-z0-9]([-a-z0-9]*[a-z0-9])?$"
+        },
+        "credential": {
+          "oneOf": [
+            {
+              "type": "object",
+              "description": "API Key authentication",
+              "required": ["type", "api_key"],
+              "properties": {
+                "type": {
+                  "type": "string",
+                  "const": "api_key"
+                },
+                "api_key": {
+                  "type": "string",
+                  "description": "API key for agent authentication",
+                  "minLength": 32
+                }
+              }
+            },
+            {
+              "type": "object",
+              "description": "OAuth2 token authentication",
+              "required": ["type", "access_token"],
+              "properties": {
+                "type": {
+                  "type": "string",
+                  "const": "oauth2"
+                },
+                "access_token": {
+                  "type": "string",
+                  "description": "OAuth2 access token"
+                },
+                "token_type": {
+                  "type": "string",
+                  "enum": ["Bearer"],
+                  "default": "Bearer"
+                }
+              }
+            },
+            {
+              "type": "object",
+              "description": "mTLS certificate authentication",
+              "required": ["type", "certificate"],
+              "properties": {
+                "type": {
+                  "type": "string",
+                  "const": "mtls"
+                },
+                "certificate": {
+                  "type": "string",
+                  "description": "Base64-encoded client certificate"
+                },
+                "certificate_chain": {
+                  "type": "array",
+                  "items": {
+                    "type": "string"
+                  },
+                  "description": "Certificate chain for validation"
+                }
+              }
+            }
+          ]
+        },
+        "instance_id": {
+          "type": "string",
+          "format": "uuid",
+          "description": "Optional: specific instance to authenticate (for instance-level auth)"
+        },
+        "scope": {
+          "type": "array",
+          "items": {
+            "type": "string",
+            "enum": ["read", "write", "execute", "admin", "messaging"]
+          },
+          "description": "Requested authorization scopes",
+          "default": ["read", "execute"]
+        },
+        "context": {
+          "type": "object",
+          "description": "Additional context for authentication",
+          "properties": {
+            "tenant_id": {
+              "type": "string"
+            },
+            "user_id": {
+              "type": "string"
+            },
+            "client_ip": {
+              "type": "string",
+              "format": "ipv4"
+            },
+            "user_agent": {
+              "type": "string"
+            }
+          }
+        }
+      },
+      "additionalProperties": false
+    },
+    "TokenResponse": {
+      "type": "object",
+      "description": "Response containing authentication token and metadata",
+      "required": [
+        "access_token",
+        "token_type",
+        "expires_in",
+        "scope"
+      ],
+      "properties": {
+        "access_token": {
+          "type": "string",
+          "description": "JWT access token for authenticated requests",
+          "minLength": 1
+        },
+        "token_type": {
+          "type": "string",
+          "enum": ["Bearer"],
+          "description": "Type of token (always Bearer for JWT)"
+        },
+        "expires_in": {
+          "type": "integer",
+          "minimum": 1,
+          "description": "Token lifetime in seconds",
+          "default": 3600
+        },
+        "refresh_token": {
+          "type": "string",
+          "description": "Optional refresh token for obtaining new access tokens"
+        },
+        "scope": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "description": "Granted authorization scopes"
+        },
+        "instance_id": {
+          "type": "string",
+          "format": "uuid",
+          "description": "Agent instance ID this token is bound to"
+        },
+        "issued_at": {
+          "type": "string",
+          "format": "date-time",
+          "description": "ISO 8601 timestamp when the token was issued"
+        },
+        "not_before": {
+          "type": "string",
+          "format": "date-time",
+          "description": "ISO 8601 timestamp before which the token is not valid"
+        },
+        "token_id": {
+          "type": "string",
+          "format": "uuid",
+          "description": "Unique identifier for this token (for revocation)"
+        }
+      },
+      "additionalProperties": false
+    },
+    "SecurityContext": {
+      "type": "object",
+      "description": "Security and authorization context for an authenticated agent",
+      "required": [
+        "authenticated",
+        "principal",
+        "scopes"
+      ],
+      "properties": {
+        "authenticated": {
+          "type": "boolean",
+          "description": "Whether the agent is successfully authenticated"
+        },
+        "principal": {
+          "type": "object",
+          "description": "Authenticated principal information",
+          "required": ["agent_id", "instance_id"],
+          "properties": {
+            "agent_id": {
+              "type": "string",
+              "description": "Authenticated agent identifier"
+            },
+            "instance_id": {
+              "type": "string",
+              "format": "uuid",
+              "description": "Authenticated agent instance ID"
+            },
+            "tenant_id": {
+              "type": "string",
+              "description": "Tenant context"
+            },
+            "user_id": {
+              "type": "string",
+              "description": "Associated user ID"
+            }
+          }
+        },
+        "scopes": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "description": "Granted authorization scopes"
+        },
+        "permissions": {
+          "type": "object",
+          "description": "Fine-grained permissions",
+          "properties": {
+            "resources": {
+              "type": "array",
+              "items": {
+                "type": "object",
+                "properties": {
+                  "resource_type": {
+                    "type": "string",
+                    "description": "Type of resource (e.g., 'agents', 'workflows', 'data')"
+                  },
+                  "resource_id": {
+                    "type": "string",
+                    "description": "Specific resource identifier or wildcard"
+                  },
+                  "actions": {
+                    "type": "array",
+                    "items": {
+                      "type": "string",
+                      "enum": ["read", "write", "delete", "execute", "admin"]
+                    },
+                    "description": "Allowed actions on this resource"
+                  }
+                }
+              },
+              "description": "Resource-level permissions"
+            },
+            "policy_version": {
+              "type": "string",
+              "description": "Version of the authorization policy applied"
+            }
+          }
+        },
+        "encryption": {
+          "type": "object",
+          "description": "Encryption requirements for this security context",
+          "properties": {
+            "in_transit": {
+              "type": "object",
+              "properties": {
+                "required": {
+                  "type": "boolean",
+                  "default": true
+                },
+                "tls_version": {
+                  "type": "string",
+                  "enum": ["1.2", "1.3"],
+                  "default": "1.3"
+                },
+                "mtls_required": {
+                  "type": "boolean",
+                  "default": false
+                }
+              }
+            },
+            "at_rest": {
+              "type": "object",
+              "properties": {
+                "required": {
+                  "type": "boolean",
+                  "default": false
+                },
+                "algorithm": {
+                  "type": "string",
+                  "enum": ["AES-256-GCM", "AES-256-CBC", "ChaCha20-Poly1305"]
+                }
+              }
+            }
+          }
+        },
+        "compliance": {
+          "type": "object",
+          "description": "Compliance and audit requirements",
+          "properties": {
+            "fips_mode": {
+              "type": "boolean",
+              "default": false,
+              "description": "Use FIPS 140-2 compliant algorithms"
+            },
+            "audit_level": {
+              "type": "string",
+              "enum": ["none", "basic", "detailed", "full"],
+              "default": "basic",
+              "description": "Level of audit logging required"
+            },
+            "retention_days": {
+              "type": "integer",
+              "minimum": 0,
+              "default": 90,
+              "description": "Audit log retention period in days"
+            }
+          }
+        },
+        "session": {
+          "type": "object",
+          "description": "Session information",
+          "properties": {
+            "session_id": {
+              "type": "string",
+              "format": "uuid",
+              "description": "Unique session identifier"
+            },
+            "created_at": {
+              "type": "string",
+              "format": "date-time"
+            },
+            "expires_at": {
+              "type": "string",
+              "format": "date-time"
+            },
+            "last_activity": {
+              "type": "string",
+              "format": "date-time"
+            }
+          }
+        }
+      },
+      "additionalProperties": false
+    },
+    "TokenRevocationRequest": {
+      "type": "object",
+      "description": "Request to revoke an authentication token",
+      "required": ["token_id"],
+      "properties": {
+        "token_id": {
+          "type": "string",
+          "format": "uuid",
+          "description": "Unique identifier of the token to revoke"
+        },
+        "reason": {
+          "type": "string",
+          "enum": ["user_request", "security_breach", "token_expired", "agent_terminated", "policy_change"],
+          "description": "Reason for token revocation"
+        }
+      },
+      "additionalProperties": false
+    },
+    "TokenRevocationResponse": {
+      "type": "object",
+      "description": "Response confirming token revocation",
+      "required": ["revoked", "token_id"],
+      "properties": {
+        "revoked": {
+          "type": "boolean",
+          "description": "Whether the token was successfully revoked"
+        },
+        "token_id": {
+          "type": "string",
+          "format": "uuid",
+          "description": "ID of the revoked token"
+        },
+        "revoked_at": {
+          "type": "string",
+          "format": "date-time",
+          "description": "Timestamp when the token was revoked"
+        }
+      },
+      "additionalProperties": false
+    }
+  }
+}