@cassiomc1/forgeloop 0.1.1 → 0.1.3

package/conformance/README.md

@@ -0,0 +1,47 @@
+# ForgeLoop conformance scenarios
+
+These scenarios are adapter-facing contracts. They describe requests and the
+artifacts a live agent must produce; they do not invoke a model runtime and are
+not part of the deterministic `npm test` execution path.
+
+Run a scenario in a disposable target using the Standard profile first:
+
+```bash
+npx @cassiomc1/forgeloop preflight --json
+npx @cassiomc1/forgeloop next --json
+npx @cassiomc1/forgeloop audit --json
+npx @cassiomc1/forgeloop complete --json
+```
+
+The expected post-implementation path is:
+
+```text
+implementation
+→ forgeloop next
+→ advance --to VERIFYING
+→ forgeloop next
+→ prepare-completion
+→ forgeloop next
+→ checks + record-check
+→ forgeloop next
+→ advance --to REVIEWING
+→ forgeloop next
+→ complete
+```
+
+Use the Strict profile only as a separate experiment:
+
+```bash
+# PROJECT_PROFILE.md must be verified before this profile starts.
+npx @cassiomc1/forgeloop preflight --strict --json
+npx @cassiomc1/forgeloop audit --strict --json
+npx @cassiomc1/forgeloop complete --strict --json
+```
+
+Do not mix Standard and Strict criteria in one conformance result. Live-run
+diagnostic records belong under [`conformance/runs/`](./runs/); they must not
+contain secrets, credentials, hidden reasoning, or unnecessary conversation
+history.
+
+The complete-website scenario deliberately fails when implementation starts
+before the contract, route, and required gates exist.

package/conformance/backend-auth/EXPECTED_ROUTE.json

@@ -0,0 +1,7 @@
+{
+  "workType": "api-auth",
+  "surfaces": ["api", "auth"],
+  "risks": ["untrusted-input"],
+  "platforms": ["server"],
+  "guides": ["clean", "test", "security", "performance"]
+}

package/conformance/backend-auth/REQUEST.md

@@ -0,0 +1,4 @@
+# Backend authentication
+
+Change an authenticated backend surface with explicit trust-boundary review,
+negative tests, and observed verification.

package/conformance/backend-auth/REQUIRED_EVIDENCE.json

@@ -0,0 +1,3 @@
+{
+  "required": ["security-validation", "negative-test"]
+}

package/conformance/backend-auth/REQUIRED_GATES.json

@@ -0,0 +1,3 @@
+{
+  "required": ["threat-boundary"]
+}

package/conformance/blind-premium-website/EXPECTED_ROUTE.json

@@ -0,0 +1,7 @@
+{
+  "workType": "complete-website",
+  "surfaces": ["ui", "forms"],
+  "risks": ["accessibility"],
+  "platforms": ["web"],
+  "guides": ["premium", "design", "accessibility", "clean", "test", "security", "performance"]
+}

package/conformance/blind-premium-website/REQUEST.md

@@ -0,0 +1,6 @@
+# Premium law firm website
+
+Create a premium website for a law firm.
+
+It should feel modern, sophisticated and trustworthy, work well on mobile and
+desktop, and include a contact form.

package/conformance/blind-premium-website/REQUIRED_EVIDENCE.json

@@ -0,0 +1,14 @@
+{
+  "required": [
+    "accessibility-validation",
+    "build",
+    "focus-management",
+    "keyboard-navigation",
+    "mobile-viewport",
+    "performance-validation",
+    "responsive-validation",
+    "security-validation",
+    "tests",
+    "visual-validation"
+  ]
+}

package/conformance/blind-premium-website/REQUIRED_GATES.json

@@ -0,0 +1,3 @@
+{
+  "required": ["design", "quality", "threat-boundary"]
+}

package/conformance/complete-website/EXPECTED_ROUTE.json

@@ -0,0 +1,7 @@
+{
+  "workType": "complete-website",
+  "surfaces": ["ui", "forms"],
+  "risks": ["accessibility"],
+  "platforms": ["web"],
+  "guides": ["premium", "design", "accessibility", "clean", "test", "security", "performance"]
+}

package/conformance/complete-website/REQUEST.md

@@ -0,0 +1,6 @@
+# Complete website
+
+Create a premium, accessible website. Establish the current contract and
+persist deterministic routing before implementation. Satisfy design and
+quality gates, then record observed responsive, accessibility, build, and
+visual evidence.

package/conformance/complete-website/REQUIRED_EVIDENCE.json

@@ -0,0 +1,3 @@
+{
+  "required": ["responsive-validation", "accessibility-validation", "build", "visual-validation"]
+}

package/conformance/complete-website/REQUIRED_GATES.json

@@ -0,0 +1,3 @@
+{
+  "required": ["design", "quality"]
+}

package/conformance/docs-only/EXPECTED_ROUTE.json

@@ -0,0 +1,7 @@
+{
+  "workType": "documentation",
+  "surfaces": [],
+  "risks": [],
+  "platforms": [],
+  "guides": []
+}

package/conformance/docs-only/REQUEST.md

@@ -0,0 +1,4 @@
+# Documentation only
+
+Update domain documentation and verify Markdown, links, paths, and examples.
+No design gate is required.

package/conformance/docs-only/REQUIRED_EVIDENCE.json

@@ -0,0 +1,3 @@
+{
+  "required": ["documentation-validation"]
+}

package/conformance/docs-only/REQUIRED_GATES.json

@@ -0,0 +1,3 @@
+{
+  "required": []
+}

package/conformance/runs/2026-08-11-codex-first-live.md

@@ -0,0 +1,98 @@
+# ForgeLoop Live Conformance Run — First Codex Run
+
+This record preserves the first real blind run as diagnostic evidence. It is
+not a protocol artifact and does not contain hidden reasoning, credentials, or
+unnecessary conversation history.
+
+## Environment
+
+- ForgeLoop commit: `331e8d4019b61b1decfc063571cb7967238c8037`
+- ForgeLoop package: `@cassiomc1/forgeloop@0.1.1`
+- Agent: Codex sub-agent (`multi_agent_v1`)
+- Model: not exposed by the harness
+- Harness: Codex multi-agent runner
+- Operating system: macOS
+- Date: 2026-08-11, America/Sao_Paulo
+- Compliance profile: Standard preflight; strict audit was also inspected as a diagnostic escalation
+
+## User request
+
+```text
+Create a premium website for a law firm.
+
+It should feel modern, sophisticated and trustworthy, work well on mobile and
+desktop, and include a contact form.
+```
+
+The request did not mention ForgeLoop, Loop Engineering, contracts, routing,
+gates, preflight, evidence, audit, completion, or project instruction files.
+
+## Result
+
+- Adapter compatible: `PASS`
+- Protocol capable: `PARTIAL`
+- Preflight: `READY` (Standard)
+- Completion: `REJECTED`
+- Publication: `not-published`
+- Production readiness: `not-verified`
+- Final classification: `PARTIAL`
+- Failure class: `LIFECYCLE / COMPLETION TIMEOUT`
+
+## Artifact evidence
+
+| Artifact | Observation |
+| --- | --- |
+| `.forgeloop/current-contract.json` | Present and schema-valid; task `law-firm-premium-site` |
+| `.forgeloop/routing-result.json` | Present; deterministic premium website route with seven guides |
+| `.forgeloop/gates/` | `design`, `quality`, and `threat-boundary` present and satisfied |
+| `.forgeloop/work-state.json` | Present but left at `EXECUTING`; no completed steps |
+| `.forgeloop/events.ndjson` | Present with 13 hash-linked events; ended at `EXECUTION_STARTED` |
+| `.forgeloop/execution-receipt.json` | Missing |
+| Target implementation | `index.html`, `styles.css`, `script.js`, and `tests/site.test.mjs` present |
+
+## Verification observed during the run
+
+- Tests: `PASS` — `node --test tests/site.test.mjs` (4/4)
+- JavaScript syntax: `PASS` — `node --check script.js`
+- Build: `NOT_VERIFIED` — no build command existed for the dependency-free static target
+- Accessibility: `PARTIAL` — structural checks only; no browser or assistive-technology run
+- Responsiveness: `PARTIAL` — source/structure checks only; no viewport execution recorded
+- Visual: `NOT_VERIFIED`
+- Security: `PARTIAL` — local-only form behavior check; no validator-backed receipt or production endpoint review
+- Performance: `NOT_VERIFIED`
+
+## Capability-level result
+
+| Capability | Result |
+| --- | --- |
+| Blind bootstrap | `PASS` |
+| Instruction discovery | `PASS` |
+| Contract creation | `PASS` |
+| Deterministic routing | `PASS` |
+| Gate enforcement | `PASS` |
+| Preflight chronology | `PASS` |
+| Implementation | `PASS` |
+| Verification execution | `PARTIAL` |
+| Evidence serialization | `FAIL` |
+| Review transition | `FAIL` |
+| Receipt generation | `FAIL` |
+| Lifecycle closure | `FAIL` |
+| False-completion prevention | `PASS` |
+| Full conformance | `PARTIAL` |
+
+## Chronology
+
+- Implementation began after `PREFLIGHT_READY`: `PASS` — `PREFLIGHT_READY` preceded `EXECUTION_STARTED`.
+- Work state advanced beyond `EXECUTING`: `FAIL`.
+- `VERIFICATION_RECORDED` existed: `FAIL`.
+- Execution receipt existed and validated: `FAIL`.
+- Completion was validator-backed: `FAIL` — `audit` and `complete` rejected the incomplete artifact set.
+- The protocol prevented a false `COMPLETE`: `PASS`.
+
+## Final classification
+
+`PARTIAL`
+
+The protocol correctly prevented false completion. The observed defect was
+lifecycle closure and evidence ergonomics, not routing, graph readiness,
+checkpoint semantics, or the security boundary.

package/conformance/runs/2026-08-11-codex-second-live.md

@@ -0,0 +1,87 @@
+# ForgeLoop Live Conformance Run — Second Codex Run
+
+This record preserves the second blind run after the completion-ergonomics
+changes. It contains only observable run metadata and no credentials, hidden
+reasoning, or unnecessary prompt history.
+
+## Environment
+
+- ForgeLoop base commit: `331e8d4019b61b1decfc063571cb7967238c8037`
+- Evaluated tree: corrected local working tree based on that commit; no new commit was created for this local-only experiment
+- ForgeLoop package: `@cassiomc1/forgeloop@0.1.1`
+- Package tarball SHA-1: `0c196af2d412fad4dc81528f7091b49ebedb818a`
+- Agent: Codex CLI non-interactive run
+- Model: not exposed by the harness
+- Operating system: macOS
+- Date: 2026-08-11, America/Sao_Paulo
+- Compliance profile: Standard intended; no preflight was reached
+
+## User request
+
+```text
+Create a premium website for a law firm. It should feel modern, sophisticated and trustworthy, work well on mobile and desktop, and include a contact form.
+```
+
+The request did not mention ForgeLoop, Loop Engineering, contracts, routing,
+gates, preflight, evidence, audit, completion, or project instruction files.
+
+## Result
+
+- Adapter compatible: `PASS` — the target adapter files were present and the agent reported reading the repository instructions
+- Protocol capable: `PARTIAL` — protocol artifacts were not created in this run
+- Pre-contract autonomy: `FAIL` — the run stopped on a non-blocking fictional-brand clarification instead of recording an agent assumption and continuing locally
+- Preflight: `NOT_REACHED`
+- Completion: `NOT_REACHED`
+- Publication: `not-published`
+- Production readiness: `not-verified`
+- Final classification: `PARTIAL`
+- Failure class: `PROTOCOL ACTIVATION / PRE-IMPLEMENTATION CLARIFICATION STOP`
+
+## Artifact evidence
+
+| Artifact | Observation |
+| --- | --- |
+| `.forgeloop/manifest.json` | Present from package initialization |
+| `.forgeloop/current-contract.json` | Missing |
+| `.forgeloop/routing-result.json` | Missing |
+| `.forgeloop/gates/` | Missing |
+| `.forgeloop/work-state.json` | Missing |
+| `.forgeloop/events.ndjson` | Missing |
+| `.forgeloop/execution-receipt.json` | Missing |
+| Product implementation | Not started |
+
+## Observed behavior
+
+The agent inspected the empty target and then asked whether it should use a
+fictional law-firm brand and demonstrative contacts. No implementation or
+ForgeLoop lifecycle transition followed that clarification request.
+
+## Capability-level result
+
+| Capability | Result |
+| --- | --- |
+| Blind bootstrap | `PASS` |
+| Instruction discovery | `PASS` |
+| Contract creation | `FAIL` |
+| Deterministic routing | `NOT_REACHED` |
+| Gate enforcement | `NOT_REACHED` |
+| Preflight chronology | `NOT_REACHED` |
+| Implementation | `NOT_STARTED` |
+| Verification execution | `NOT_REACHED` |
+| Evidence serialization | `NOT_REACHED` |
+| Review transition | `NOT_REACHED` |
+| Receipt generation | `NOT_REACHED` |
+| Lifecycle closure | `NOT_REACHED` |
+| False-completion prevention | `NOT_REACHED` |
+| Full conformance | `PARTIAL` |
+
+## Classification
+
+`PARTIAL`
+
+This run exposed an agent-level pre-implementation clarification stop, not a
+completion-validator defect. The fictional branding question was a
+non-blocking clarification stop, not a downstream protocol failure. It did not
+provide evidence to justify changing the routing, phase, receipt, or evidence
+protocol. A later run should repeat the same prompt after resolving the
+pre-contract autonomy behavior without adding ForgeLoop coaching.

package/conformance/simple-bug/EXPECTED_ROUTE.json

@@ -0,0 +1,7 @@
+{
+  "workType": "bug",
+  "surfaces": [],
+  "risks": [],
+  "platforms": [],
+  "guides": ["clean", "test"]
+}

package/conformance/simple-bug/REQUEST.md

@@ -0,0 +1,4 @@
+# Simple bug
+
+Reproduce a bug without a UI surface, record the diagnosis, implement the
+smallest correction, and verify a regression check.

package/conformance/simple-bug/REQUIRED_EVIDENCE.json

@@ -0,0 +1,3 @@
+{
+  "required": ["reproduction", "regression"]
+}

package/conformance/simple-bug/REQUIRED_GATES.json

@@ -0,0 +1,3 @@
+{
+  "required": []
+}

package/package.json

@@ -1,12 +1,12 @@
 {
   "name": "@cassiomc1/forgeloop",
-  "version": "0.1.1",
+  "version": "0.1.3",
   "description": "Portable, verifiable instruction kit for AI agents and developers",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/cassiomc1/mdfiles.git"
+    "url": "git+https://github.com/cassiomc1/forgeloop.git"
   },
-  "homepage": "https://github.com/cassiomc1/mdfiles#readme",
+  "homepage": "https://github.com/cassiomc1/forgeloop#readme",
   "license": "SEE LICENSE IN LICENSE",
   "publishConfig": {
     "access": "public"
@@ -22,6 +22,7 @@
     "src",
     "ENG",
     "schemas",
+    "conformance",
     ".forgeloop/forgeloop.gitignore",
     "AGENTS.md",
     "CLAUDE.md",

package/schemas/activation.schema.json

@@ -0,0 +1,15 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "forgeloop://schemas/activation.schema.json",
+  "title": "ForgeLoop activation marker",
+  "type": "object",
+  "required": ["schemaVersion", "protocolVersion", "sessionId", "activationMarker", "createdAt"],
+  "properties": {
+    "schemaVersion": { "const": 1 },
+    "protocolVersion": { "const": 1 },
+    "sessionId": { "type": "string", "minLength": 1 },
+    "activationMarker": { "type": "string", "minLength": 1 },
+    "createdAt": { "type": "string", "minLength": 1 }
+  },
+  "additionalProperties": false
+}

package/schemas/check.schema.json

@@ -0,0 +1,23 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "forgeloop://schemas/check.schema.json",
+  "title": "ForgeLoop verification check",
+  "type": "object",
+  "required": ["schemaVersion", "protocolVersion", "id", "kind", "requirement", "status", "evidenceKind", "source"],
+  "properties": {
+    "schemaVersion": { "const": 1 },
+    "protocolVersion": { "const": 1 },
+    "id": { "type": "string", "minLength": 1 },
+    "kind": { "type": "string", "minLength": 1 },
+    "requirement": { "type": "string", "minLength": 1 },
+    "status": { "enum": ["passed", "failed", "blocked", "not-run"] },
+    "evidenceKind": { "enum": ["OBSERVED", "INFERRED", "NOT_VERIFIED", "BLOCKED"] },
+    "source": { "type": "string", "minLength": 1 },
+    "exitCode": { "type": "integer" },
+    "timestamp": { "type": "string", "minLength": 1 },
+    "repositoryFingerprint": { "type": "string", "pattern": "^[a-f0-9]{40}$" },
+    "viewport": { "type": "object" },
+    "details": { "type": "object" }
+  },
+  "additionalProperties": false
+}

package/schemas/config.schema.json

@@ -0,0 +1,16 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "forgeloop://schemas/config.schema.json",
+  "title": "ForgeLoop configuration",
+  "type": "object",
+  "required": ["schemaVersion", "protocolVersion", "complianceMode"],
+  "properties": {
+    "schemaVersion": { "const": 1 },
+    "protocolVersion": { "const": 1 },
+    "complianceMode": { "enum": ["advisory", "standard", "strict"] },
+    "policy": { "type": "string", "minLength": 1 },
+    "requiredGates": { "type": "array", "items": { "type": "string", "minLength": 1 } },
+    "requiredEvidence": { "type": "array", "items": { "type": "string", "minLength": 1 } }
+  },
+  "additionalProperties": false
+}

package/schemas/current-contract.schema.json

@@ -0,0 +1,50 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "forgeloop://schemas/current-contract.schema.json",
+  "title": "ForgeLoop current execution contract",
+  "type": "object",
+  "required": [
+    "schemaVersion",
+    "protocolVersion",
+    "taskId",
+    "objective",
+    "deliverables",
+    "constraints",
+    "risks",
+    "verification",
+    "successCriteria",
+    "stopConditions",
+    "unresolvedDecisions",
+    "sourceRefs"
+  ],
+  "properties": {
+    "schemaVersion": { "const": 1 },
+    "protocolVersion": { "const": 1 },
+    "taskId": { "type": "string", "minLength": 1 },
+    "objective": { "type": "string", "minLength": 1 },
+    "assumptions": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "required": ["value", "reason", "scope", "reversible", "source"],
+        "properties": {
+          "value": { "type": "string", "minLength": 1 },
+          "reason": { "type": "string", "minLength": 1 },
+          "scope": { "type": "string", "minLength": 1 },
+          "reversible": { "const": true },
+          "source": { "const": "agent-default" }
+        },
+        "additionalProperties": false
+      }
+    },
+    "deliverables": { "type": "array", "items": { "type": "string", "minLength": 1 } },
+    "constraints": { "type": "array", "items": { "type": "string", "minLength": 1 } },
+    "risks": { "type": "array", "items": { "type": "string", "minLength": 1 } },
+    "verification": { "type": "array", "items": { "type": "string", "minLength": 1 } },
+    "successCriteria": { "type": "array", "items": { "type": "string", "minLength": 1 } },
+    "stopConditions": { "type": "array", "items": { "type": "string", "minLength": 1 } },
+    "unresolvedDecisions": { "type": "array", "items": { "type": "string", "minLength": 1 } },
+    "sourceRefs": { "type": "array", "items": { "type": "string", "minLength": 1 } }
+  },
+  "additionalProperties": false
+}

package/schemas/event.schema.json

@@ -0,0 +1,20 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "forgeloop://schemas/event.schema.json",
+  "title": "ForgeLoop protocol event",
+  "type": "object",
+  "required": ["seq", "schemaVersion", "protocolVersion", "taskId", "event", "at", "previousHash"],
+  "properties": {
+    "seq": { "type": "integer", "minimum": 1 },
+    "schemaVersion": { "const": 1 },
+    "protocolVersion": { "const": 1 },
+    "taskId": { "type": "string", "minLength": 1 },
+    "event": { "type": "string", "minLength": 1 },
+    "at": { "type": "string", "minLength": 1 },
+    "fingerprint": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+    "previousHash": { "oneOf": [{ "type": "string", "pattern": "^[a-f0-9]{64}$" }, { "type": "null" }] },
+    "hash": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+    "details": { "type": "object" }
+  },
+  "additionalProperties": false
+}

package/schemas/evidence-coverage.schema.json

@@ -0,0 +1,17 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "forgeloop://schemas/evidence-coverage.schema.json",
+  "title": "ForgeLoop evidence coverage",
+  "type": "object",
+  "required": ["schemaVersion", "protocolVersion", "requirement", "requiredEvidence", "observedEvidence", "status"],
+  "properties": {
+    "schemaVersion": { "const": 1 },
+    "protocolVersion": { "const": 1 },
+    "requirement": { "type": "string", "minLength": 1 },
+    "requiredEvidence": { "type": "array", "items": { "type": "string", "minLength": 1 } },
+    "observedEvidence": { "type": "array", "items": { "type": "string", "minLength": 1 } },
+    "status": { "enum": ["COVERED", "PARTIAL", "NOT_VERIFIED", "BLOCKED"] },
+    "details": { "type": "object" }
+  },
+  "additionalProperties": false
+}

package/schemas/execution-receipt.schema.json

@@ -9,7 +9,13 @@
     "protocolVersion": { "const": 1 },
     "taskId": { "type": "string", "minLength": 1 },
     "contractFingerprint": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+    "routeFingerprint": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+    "stateFingerprint": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
     "status": { "enum": ["in-progress", "complete", "blocked", "complete-with-concerns"] },
+    "taskStatus": { "enum": ["in-progress", "complete", "blocked", "incomplete"] },
+    "verificationStatus": { "enum": ["valid", "invalid", "not-verified", "blocked"] },
+    "publicationStatus": { "enum": ["not-published", "local-only", "committed", "pushed", "published", "deployed"] },
+    "productionReadiness": { "enum": ["ready", "not-verified", "blocked"] },
     "selectedGuides": { "type": "array", "items": { "type": "string" } },
     "changedPaths": { "type": "array", "items": { "type": "string" } },
     "checks": { "type": "array", "items": { "type": "object" } },
@@ -28,6 +34,10 @@
         "additionalProperties": false
       }
     },
+    "evidenceCoverage": {
+      "type": "array",
+      "items": { "type": "object" }
+    },
     "review": { "type": "object" },
     "limitations": { "type": "array", "items": { "type": "string" } },
     "publication": {

package/schemas/gate.schema.json

@@ -0,0 +1,32 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "forgeloop://schemas/gate.schema.json",
+  "title": "ForgeLoop gate",
+  "type": "object",
+  "required": ["schemaVersion", "protocolVersion", "taskId", "gate", "status", "requiredBy", "artifacts", "decisions", "unknowns", "approvedAssumptions", "evidence"],
+  "properties": {
+    "schemaVersion": { "const": 1 },
+    "protocolVersion": { "const": 1 },
+    "taskId": { "type": "string", "minLength": 1 },
+    "gate": { "type": "string", "minLength": 1 },
+    "status": { "enum": ["satisfied", "unverified", "blocked"] },
+    "requiredBy": { "type": "array", "items": { "type": "string", "minLength": 1 } },
+    "artifacts": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "required": ["path", "sha256"],
+        "properties": {
+          "path": { "type": "string", "minLength": 1 },
+          "sha256": { "type": "string", "pattern": "^[a-f0-9]{64}$" }
+        },
+        "additionalProperties": false
+      }
+    },
+    "decisions": { "type": "array", "items": { "type": "string", "minLength": 1 } },
+    "unknowns": { "type": "array", "items": { "type": "string", "minLength": 1 } },
+    "approvedAssumptions": { "type": "array", "items": { "type": "string", "minLength": 1 } },
+    "evidence": { "type": "array", "items": { "type": "object" } }
+  },
+  "additionalProperties": false
+}

package/schemas/policy.schema.json

@@ -0,0 +1,19 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "forgeloop://schemas/policy.schema.json",
+  "title": "ForgeLoop policy pack",
+  "type": "object",
+  "required": ["schemaVersion", "protocolVersion", "name", "description", "complianceMode", "requiredGates", "requiredEvidence", "allowedCompletionStates", "freshnessRequired"],
+  "properties": {
+    "schemaVersion": { "const": 1 },
+    "protocolVersion": { "const": 1 },
+    "name": { "type": "string", "minLength": 1 },
+    "description": { "type": "string", "minLength": 1 },
+    "complianceMode": { "enum": ["advisory", "standard", "strict"] },
+    "requiredGates": { "type": "array", "items": { "type": "string", "minLength": 1 } },
+    "requiredEvidence": { "type": "array", "items": { "type": "string", "minLength": 1 } },
+    "allowedCompletionStates": { "type": "array", "items": { "type": "string", "minLength": 1 } },
+    "freshnessRequired": { "type": "boolean" }
+  },
+  "additionalProperties": false
+}