@echopath-labs/forgerail 0.1.0-alpha.1 → 0.1.0-alpha.2

package/contracts/effective-profile-v2.schema.json

@@ -0,0 +1,113 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://forgerail.dev/schemas/effective-profile-v2.json",
+  "title": "ForgeRail Effective Profile v2",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schemaVersion", "profileId", "revisionId", "workspaceIdentityId", "computed", "computedAt", "completeness", "sourceIds", "workspaceRelationshipIds", "ruleClaims", "dependencyEdges", "applicablePackIds", "conflicts", "explanationId", "limitedReasons"],
+  "properties": {
+    "schemaVersion": { "const": "2.0" },
+    "profileId": { "type": "string", "pattern": "^[a-zA-Z0-9][a-zA-Z0-9._:-]+$" },
+    "revisionId": { "type": "string", "pattern": "^[a-zA-Z0-9][a-zA-Z0-9._:-]+$" },
+    "workspaceIdentityId": { "type": "string", "pattern": "^[a-zA-Z0-9][a-zA-Z0-9._:-]+$" },
+    "computed": { "const": true },
+    "computedAt": { "type": "string", "format": "date-time" },
+    "completeness": { "enum": ["complete", "degraded", "unresolved"] },
+    "sourceIds": { "type": "array", "items": { "type": "string", "pattern": "^[a-zA-Z0-9][a-zA-Z0-9._:-]+$" }, "uniqueItems": true },
+    "workspaceRelationshipIds": { "type": "array", "items": { "type": "string", "pattern": "^[a-zA-Z0-9][a-zA-Z0-9._:-]+$" }, "uniqueItems": true },
+    "ruleClaims": { "type": "array", "items": { "$ref": "https://forgerail.dev/schemas/rule-claim-v1.json" } },
+    "dependencyEdges": { "type": "array", "items": { "$ref": "https://forgerail.dev/schemas/source-dependency-edge-v1.json" } },
+    "applicablePackIds": { "type": "array", "items": { "type": "string", "pattern": "^[a-z][a-z0-9-]+$" }, "uniqueItems": true },
+    "conflicts": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["conflictId", "claimIds", "status", "limitedReason"],
+        "properties": {
+          "conflictId": { "type": "string", "pattern": "^[a-zA-Z0-9][a-zA-Z0-9._:-]+$" },
+          "claimIds": { "type": "array", "items": { "type": "string", "pattern": "^[a-zA-Z0-9][a-zA-Z0-9._:-]+$" }, "minItems": 2, "uniqueItems": true },
+          "status": { "const": "unresolved" },
+          "limitedReason": { "type": "string", "minLength": 1 }
+        }
+      }
+    },
+    "explanationId": { "type": "string", "pattern": "^[a-zA-Z0-9][a-zA-Z0-9._:-]+$" },
+    "limitedReasons": { "type": "array", "items": { "type": "string", "minLength": 1 }, "uniqueItems": true }
+  },
+  "allOf": [
+    {
+      "if": { "properties": { "completeness": { "const": "complete" } }, "required": ["completeness"] },
+      "then": {
+        "properties": {
+          "conflicts": { "maxItems": 0 },
+          "limitedReasons": { "maxItems": 0 },
+          "ruleClaims": {
+            "not": {
+              "contains": {
+                "type": "object",
+                "properties": { "enforcement": { "const": "unresolved" } },
+                "required": ["enforcement"]
+              }
+            }
+          },
+          "dependencyEdges": {
+            "not": {
+              "contains": {
+                "type": "object",
+                "properties": { "observationStatus": { "enum": ["unavailable", "ambiguous", "unverified"] } },
+                "required": ["observationStatus"]
+              }
+            }
+          }
+        }
+      }
+    },
+    {
+      "if": { "properties": { "completeness": { "enum": ["degraded", "unresolved"] } }, "required": ["completeness"] },
+      "then": { "properties": { "limitedReasons": { "minItems": 1 } } }
+    },
+    {
+      "if": {
+        "properties": {
+          "ruleClaims": {
+            "contains": {
+              "type": "object",
+              "properties": { "enforcement": { "const": "unresolved" } },
+              "required": ["enforcement"]
+            }
+          }
+        },
+        "required": ["ruleClaims"]
+      },
+      "then": { "properties": { "completeness": { "const": "unresolved" } } }
+    },
+    {
+      "if": {
+        "properties": {
+          "dependencyEdges": {
+            "contains": {
+              "type": "object",
+              "allOf": [
+                {
+                  "properties": { "requiredness": { "const": "required" } },
+                  "required": ["requiredness"]
+                },
+                {
+                  "properties": { "observationStatus": { "enum": ["unavailable", "ambiguous", "unverified"] } },
+                  "required": ["observationStatus"]
+                }
+              ]
+            }
+          }
+        },
+        "required": ["dependencyEdges"]
+      },
+      "then": { "properties": { "completeness": { "const": "unresolved" } } }
+    },
+    {
+      "if": { "properties": { "conflicts": { "minItems": 1 } }, "required": ["conflicts"] },
+      "then": { "properties": { "completeness": { "const": "unresolved" } } }
+    }
+  ]
+}

package/contracts/entry-mode-v1.schema.json

@@ -0,0 +1,20 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://forgerail.dev/schemas/entry-mode-v1.json",
+  "title": "ForgeRail Entry Mode v1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schemaVersion", "mode", "sourceEvidenceIds", "observedAt"],
+  "properties": {
+    "schemaVersion": { "const": "1.0" },
+    "mode": { "enum": ["new", "resumed", "imported"] },
+    "sourceEvidenceIds": { "type": "array", "items": { "type": "string", "pattern": "^[a-zA-Z0-9][a-zA-Z0-9._:-]+$" }, "uniqueItems": true },
+    "observedAt": { "type": "string", "format": "date-time" }
+  },
+  "allOf": [
+    {
+      "if": { "properties": { "mode": { "enum": ["resumed", "imported"] } }, "required": ["mode"] },
+      "then": { "properties": { "sourceEvidenceIds": { "minItems": 1 } } }
+    }
+  ]
+}

package/contracts/evidence-identity-v1.schema.json

@@ -0,0 +1,48 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://forgerail.dev/schemas/evidence-identity-v1.json",
+  "title": "ForgeRail Evidence Identity v1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schemaVersion", "evidenceId", "workspaceIdentityId", "scopeKind", "taskId", "subjectId", "envelopeRevisionId", "controlRevisionId", "source", "contentDigest", "observedAt", "availability", "sanitized", "limitedReason"],
+  "properties": {
+    "schemaVersion": { "const": "1.0" },
+    "evidenceId": { "type": "string", "pattern": "^[a-zA-Z0-9][a-zA-Z0-9._:-]+$" },
+    "workspaceIdentityId": { "type": "string", "pattern": "^[a-zA-Z0-9][a-zA-Z0-9._:-]+$" },
+    "scopeKind": { "enum": ["workspace", "task", "subject"] },
+    "taskId": { "type": ["string", "null"], "pattern": "^[a-zA-Z0-9][a-zA-Z0-9._:-]+$" },
+    "subjectId": { "type": ["string", "null"], "pattern": "^[a-zA-Z0-9][a-zA-Z0-9._:-]+$" },
+    "envelopeRevisionId": { "type": ["string", "null"], "pattern": "^[a-zA-Z0-9][a-zA-Z0-9._:-]+$" },
+    "controlRevisionId": { "type": ["string", "null"], "pattern": "^[a-zA-Z0-9][a-zA-Z0-9._:-]+$" },
+    "source": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["kind", "providerId", "locator", "providerEvidenceId"],
+      "properties": {
+        "kind": { "enum": ["file", "git", "test", "log", "provider", "external-receipt", "agent-claim", "other"] },
+        "providerId": { "type": ["string", "null"], "pattern": "^[a-z][a-z0-9-]+$" },
+        "locator": { "type": "string", "minLength": 1 },
+        "providerEvidenceId": { "type": ["string", "null"] }
+      }
+    },
+    "contentDigest": { "type": ["string", "null"], "pattern": "^[0-9a-f]{64}$" },
+    "observedAt": { "type": "string", "format": "date-time" },
+    "availability": { "enum": ["available", "unavailable", "unverified"] },
+    "sanitized": { "const": true },
+    "limitedReason": { "type": ["string", "null"], "minLength": 1 }
+  },
+  "allOf": [
+    {
+      "if": { "properties": { "scopeKind": { "enum": ["task", "subject"] } }, "required": ["scopeKind"] },
+      "then": { "properties": { "taskId": { "type": "string" }, "envelopeRevisionId": { "type": "string" }, "controlRevisionId": { "type": "string" } } }
+    },
+    {
+      "if": { "properties": { "scopeKind": { "const": "subject" } }, "required": ["scopeKind"] },
+      "then": { "properties": { "subjectId": { "type": "string" } } }
+    },
+    {
+      "if": { "properties": { "availability": { "enum": ["unavailable", "unverified"] } }, "required": ["availability"] },
+      "then": { "properties": { "limitedReason": { "type": "string", "minLength": 1 } } }
+    }
+  ]
+}

package/contracts/execution-context-identity-v1.schema.json

@@ -0,0 +1,76 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://forgerail.dev/schemas/execution-context-identity-v1.json",
+  "title": "ForgeRail Execution Context Identity v1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schemaVersion", "executionContextIdentityId", "workspaceIdentityId", "subjectId", "entrypoint", "invocationRoot", "executor", "runner", "toolIdentities", "providerIdentities", "dependencies", "observedAt", "sanitized"],
+  "properties": {
+    "schemaVersion": { "const": "1.0" },
+    "executionContextIdentityId": { "type": "string", "pattern": "^[a-zA-Z0-9][a-zA-Z0-9._:-]+$" },
+    "workspaceIdentityId": { "type": "string", "pattern": "^[a-zA-Z0-9][a-zA-Z0-9._:-]+$" },
+    "subjectId": { "type": "string", "pattern": "^[a-zA-Z0-9][a-zA-Z0-9._:-]+$" },
+    "entrypoint": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["entrypointId", "kind", "locator", "digest"],
+      "properties": {
+        "entrypointId": { "type": "string", "pattern": "^[a-zA-Z0-9][a-zA-Z0-9._:-]+$" },
+        "kind": { "enum": ["documented", "local-command", "hook", "ci", "nightly", "protected-environment", "other"] },
+        "locator": { "type": "string", "minLength": 1 },
+        "digest": { "type": ["string", "null"], "pattern": "^[0-9a-f]{64}$" }
+      }
+    },
+    "invocationRoot": { "type": "string", "minLength": 1 },
+    "executor": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["executorId", "kind"],
+      "properties": {
+        "executorId": { "type": "string", "minLength": 1 },
+        "kind": { "enum": ["host-agent", "human", "local-process", "provider-runner", "other"] }
+      }
+    },
+    "runner": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["runnerId", "trustClass"],
+      "properties": {
+        "runnerId": { "type": "string", "minLength": 1 },
+        "trustClass": { "enum": ["self-reported", "local-observed", "provider-attested", "trusted-runner", "protected-environment"] }
+      }
+    },
+    "toolIdentities": { "type": "array", "items": { "type": "string", "minLength": 1 }, "uniqueItems": true },
+    "providerIdentities": { "type": "array", "items": { "type": "string", "minLength": 1 }, "uniqueItems": true },
+    "dependencies": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["dependencyId", "kind", "locator", "boundary", "declared", "availability", "evidenceIdentityId", "limitedReason"],
+        "properties": {
+          "dependencyId": { "type": "string", "pattern": "^[a-zA-Z0-9][a-zA-Z0-9._:-]+$" },
+          "kind": { "enum": ["environment-file", "configuration", "credential", "toolchain", "network-service", "provider-state", "other"] },
+          "locator": { "type": "string", "minLength": 1 },
+          "boundary": { "enum": ["workspace-contained", "allowlisted-external", "undeclared-external", "unavailable-external"] },
+          "declared": { "type": "boolean" },
+          "availability": { "enum": ["available", "unavailable", "unverified"] },
+          "evidenceIdentityId": { "type": ["string", "null"], "pattern": "^[a-zA-Z0-9][a-zA-Z0-9._:-]+$" },
+          "limitedReason": { "anyOf": [{ "$ref": "https://forgerail.dev/schemas/limited-reason-v1.json" }, { "type": "null" }] }
+        },
+        "allOf": [
+          {
+            "if": { "properties": { "availability": { "enum": ["unavailable", "unverified"] } }, "required": ["availability"] },
+            "then": { "properties": { "limitedReason": { "$ref": "https://forgerail.dev/schemas/limited-reason-v1.json" } } }
+          },
+          {
+            "if": { "properties": { "boundary": { "enum": ["undeclared-external", "unavailable-external"] } }, "required": ["boundary"] },
+            "then": { "properties": { "limitedReason": { "$ref": "https://forgerail.dev/schemas/limited-reason-v1.json" } } }
+          }
+        ]
+      }
+    },
+    "observedAt": { "type": "string", "format": "date-time" },
+    "sanitized": { "const": true }
+  }
+}

package/contracts/gate-result-v1.schema.json

@@ -0,0 +1,32 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://forgerail.dev/schemas/gate-result-v1.json",
+  "title": "ForgeRail Gate Result v1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schemaVersion", "gateResultId", "gateId", "gateKind", "workspaceIdentityId", "envelopeRevisionId", "controlRevisionId", "subjectId", "disposition", "evidenceIdentityIds", "evaluatedAt", "limitedReason"],
+  "properties": {
+    "schemaVersion": { "const": "1.0" },
+    "gateResultId": { "type": "string", "pattern": "^[a-zA-Z0-9][a-zA-Z0-9._:-]+$" },
+    "gateId": { "type": "string", "pattern": "^[a-zA-Z0-9][a-zA-Z0-9._:-]+$" },
+    "gateKind": { "enum": ["operation-authorization", "review-authority", "validation", "governance-dependency", "receipt-verification"] },
+    "workspaceIdentityId": { "type": "string", "pattern": "^[a-zA-Z0-9][a-zA-Z0-9._:-]+$" },
+    "envelopeRevisionId": { "type": "string", "pattern": "^[a-zA-Z0-9][a-zA-Z0-9._:-]+$" },
+    "controlRevisionId": { "type": "string", "pattern": "^[a-zA-Z0-9][a-zA-Z0-9._:-]+$" },
+    "subjectId": { "type": "string", "pattern": "^[a-zA-Z0-9][a-zA-Z0-9._:-]+$" },
+    "disposition": { "enum": ["satisfied", "unsatisfied", "blocked", "deviation_requires_review"] },
+    "evidenceIdentityIds": { "type": "array", "items": { "type": "string", "pattern": "^[a-zA-Z0-9][a-zA-Z0-9._:-]+$" }, "uniqueItems": true },
+    "evaluatedAt": { "type": "string", "format": "date-time" },
+    "limitedReason": { "type": ["string", "null"], "minLength": 1 }
+  },
+  "allOf": [
+    {
+      "if": { "properties": { "disposition": { "const": "satisfied" } }, "required": ["disposition"] },
+      "then": { "properties": { "evidenceIdentityIds": { "minItems": 1 }, "limitedReason": { "const": null } } }
+    },
+    {
+      "if": { "properties": { "disposition": { "enum": ["unsatisfied", "blocked", "deviation_requires_review"] } }, "required": ["disposition"] },
+      "then": { "properties": { "limitedReason": { "type": "string", "minLength": 1 } } }
+    }
+  ]
+}

package/contracts/governance-source-v1.schema.json

@@ -0,0 +1,30 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://forgerail.dev/schemas/governance-source-v1.json",
+  "title": "ForgeRail Governance Source v1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schemaVersion", "sourceId", "workspaceIdentityId", "sourceKind", "locator", "ownerId", "precedenceClass", "applicabilityScope", "workspaceRelationshipIds", "observationStatus", "ruleClaimIds", "dependencyEdgeIds", "observedAt", "limitedReason"],
+  "properties": {
+    "schemaVersion": { "const": "1.0" },
+    "sourceId": { "type": "string", "pattern": "^[a-zA-Z0-9][a-zA-Z0-9._:-]+$" },
+    "workspaceIdentityId": { "type": "string", "pattern": "^[a-zA-Z0-9][a-zA-Z0-9._:-]+$" },
+    "sourceKind": { "enum": ["instructions", "ownership", "platform-policy", "ci", "script", "specification", "decision-record", "structured-profile", "other"] },
+    "locator": { "type": "string", "minLength": 1 },
+    "ownerId": { "type": ["string", "null"], "minLength": 1 },
+    "precedenceClass": { "type": "string", "minLength": 1 },
+    "applicabilityScope": { "type": "array", "items": { "type": "string", "minLength": 1 }, "minItems": 1, "uniqueItems": true },
+    "workspaceRelationshipIds": { "type": "array", "items": { "type": "string", "pattern": "^[a-zA-Z0-9][a-zA-Z0-9._:-]+$" }, "uniqueItems": true },
+    "observationStatus": { "enum": ["observed", "unavailable", "ambiguous", "unverified"] },
+    "ruleClaimIds": { "type": "array", "items": { "type": "string", "pattern": "^[a-zA-Z0-9][a-zA-Z0-9._:-]+$" }, "uniqueItems": true },
+    "dependencyEdgeIds": { "type": "array", "items": { "type": "string", "pattern": "^[a-zA-Z0-9][a-zA-Z0-9._:-]+$" }, "uniqueItems": true },
+    "observedAt": { "type": "string", "format": "date-time" },
+    "limitedReason": { "type": ["string", "null"], "minLength": 1 }
+  },
+  "allOf": [
+    {
+      "if": { "properties": { "observationStatus": { "enum": ["unavailable", "ambiguous", "unverified"] } }, "required": ["observationStatus"] },
+      "then": { "properties": { "limitedReason": { "type": "string", "minLength": 1 } } }
+    }
+  ]
+}

package/contracts/host-adapter-observation-v1.schema.json

@@ -0,0 +1,61 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://forgerail.dev/schemas/host-adapter-observation-v1.json",
+  "title": "ForgeRail Host Adapter Observation v1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schemaVersion", "observationId", "adapterId", "adapterVersion", "hostIdentityId", "workspaceIdentityId", "scopeKind", "taskId", "subjectId", "controlRevisionId", "authorizationClaim", "capabilities", "observedAt", "sanitized"],
+  "properties": {
+    "schemaVersion": { "const": "1.0" },
+    "observationId": { "type": "string", "pattern": "^[a-zA-Z0-9][a-zA-Z0-9._:-]+$" },
+    "adapterId": { "type": "string", "pattern": "^[a-z][a-z0-9-]+$" },
+    "adapterVersion": { "type": "string", "minLength": 1 },
+    "hostIdentityId": { "type": "string", "minLength": 1 },
+    "workspaceIdentityId": { "type": "string", "pattern": "^[a-zA-Z0-9][a-zA-Z0-9._:-]+$" },
+    "scopeKind": { "enum": ["workspace", "task", "subject"] },
+    "taskId": { "type": ["string", "null"], "pattern": "^[a-zA-Z0-9][a-zA-Z0-9._:-]+$" },
+    "subjectId": { "type": ["string", "null"], "pattern": "^[a-zA-Z0-9][a-zA-Z0-9._:-]+$" },
+    "controlRevisionId": { "type": ["string", "null"], "pattern": "^[a-zA-Z0-9][a-zA-Z0-9._:-]+$" },
+    "authorizationClaim": { "const": false },
+    "capabilities": {
+      "type": "array",
+      "minItems": 1,
+      "items": { "$ref": "#/$defs/capabilityObservation" }
+    },
+    "observedAt": { "type": "string", "format": "date-time" },
+    "sanitized": { "const": true }
+  },
+  "$defs": {
+    "capabilityObservation": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["capability", "state", "evidenceIdentityIds", "limitedReason"],
+      "properties": {
+        "capability": { "enum": ["instruction-discovery", "workspace-boundary-discovery", "skill-or-plugin-discovery", "binding", "activation", "mutation", "execution-context", "verification"] },
+        "state": { "enum": ["supported", "profile-only", "degraded", "blocked", "unavailable", "unknown"] },
+        "evidenceIdentityIds": { "type": "array", "items": { "type": "string", "pattern": "^[a-zA-Z0-9][a-zA-Z0-9._:-]+$" }, "uniqueItems": true },
+        "limitedReason": { "anyOf": [{ "$ref": "https://forgerail.dev/schemas/limited-reason-v1.json" }, { "type": "null" }] }
+      },
+      "allOf": [
+        {
+          "if": { "properties": { "state": { "const": "supported" } }, "required": ["state"] },
+          "then": { "properties": { "evidenceIdentityIds": { "minItems": 1 }, "limitedReason": { "const": null } } }
+        },
+        {
+          "if": { "properties": { "state": { "enum": ["profile-only", "degraded", "blocked", "unavailable", "unknown"] } }, "required": ["state"] },
+          "then": { "properties": { "limitedReason": { "$ref": "https://forgerail.dev/schemas/limited-reason-v1.json" } } }
+        }
+      ]
+    }
+  },
+  "allOf": [
+    {
+      "if": { "properties": { "scopeKind": { "enum": ["task", "subject"] } }, "required": ["scopeKind"] },
+      "then": { "properties": { "taskId": { "type": "string" }, "controlRevisionId": { "type": "string" } } }
+    },
+    {
+      "if": { "properties": { "scopeKind": { "const": "subject" } }, "required": ["scopeKind"] },
+      "then": { "properties": { "subjectId": { "type": "string" } } }
+    }
+  ]
+}

package/contracts/limited-reason-v1.schema.json

@@ -0,0 +1,46 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://forgerail.dev/schemas/limited-reason-v1.json",
+  "title": "ForgeRail Limited Reason v1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schemaVersion", "reasonId", "code", "impact", "summary", "evidenceIdentityIds", "locators", "observedAt", "sanitized"],
+  "properties": {
+    "schemaVersion": { "const": "1.0" },
+    "reasonId": { "type": "string", "pattern": "^[a-zA-Z0-9][a-zA-Z0-9._:-]+$" },
+    "code": {
+      "enum": [
+        "missing-required-evidence",
+        "unavailable-provider",
+        "unauthenticated-provider",
+        "unverified-adapter",
+        "stale-evidence",
+        "revoked-evidence",
+        "dismissed-evidence",
+        "expired-evidence",
+        "superseded-evidence",
+        "wrong-subject",
+        "wrong-trust",
+        "unclassified-surface",
+        "missing-result",
+        "unexpected-result",
+        "dangling-dependency",
+        "blocked-prerequisite",
+        "boundary-crossing-dependency",
+        "redacted-sensitive-detail",
+        "unsupported-capability",
+        "other"
+      ]
+    },
+    "impact": { "enum": ["degraded", "blocked", "unavailable", "unresolved", "unverified"] },
+    "summary": { "type": "string", "minLength": 1, "maxLength": 500 },
+    "evidenceIdentityIds": {
+      "type": "array",
+      "items": { "type": "string", "pattern": "^[a-zA-Z0-9][a-zA-Z0-9._:-]+$" },
+      "uniqueItems": true
+    },
+    "locators": { "type": "array", "items": { "type": "string", "minLength": 1 }, "uniqueItems": true },
+    "observedAt": { "type": "string", "format": "date-time" },
+    "sanitized": { "const": true }
+  }
+}

package/contracts/operation-authority-requirement-v1.schema.json

@@ -0,0 +1,43 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://forgerail.dev/schemas/operation-authority-requirement-v1.json",
+  "title": "ForgeRail Operation Authority Requirement v1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schemaVersion", "requirementId", "workspaceIdentityId", "operation", "target", "subjectId", "scope", "eligibleIssuerSourceIds", "acceptedIssuerEvidenceKinds", "freshness", "declaredAt"],
+  "properties": {
+    "schemaVersion": { "const": "1.0" },
+    "requirementId": { "type": "string", "pattern": "^[a-zA-Z0-9][a-zA-Z0-9._:-]+$" },
+    "workspaceIdentityId": { "type": "string", "pattern": "^[a-zA-Z0-9][a-zA-Z0-9._:-]+$" },
+    "operation": { "type": "string", "minLength": 1 },
+    "target": { "$ref": "#/$defs/target" },
+    "subjectId": { "type": "string", "pattern": "^[a-zA-Z0-9][a-zA-Z0-9._:-]+$" },
+    "scope": { "type": "array", "items": { "type": "string", "minLength": 1 }, "minItems": 1, "uniqueItems": true },
+    "eligibleIssuerSourceIds": { "type": "array", "items": { "type": "string", "pattern": "^[a-zA-Z0-9][a-zA-Z0-9._:-]+$" }, "minItems": 1, "uniqueItems": true },
+    "acceptedIssuerEvidenceKinds": { "type": "array", "items": { "type": "string", "minLength": 1 }, "minItems": 1, "uniqueItems": true },
+    "freshness": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["maxAgeSeconds", "expiresRequired"],
+      "properties": {
+        "maxAgeSeconds": { "type": "integer", "minimum": 1 },
+        "expiresRequired": { "type": "boolean" }
+      }
+    },
+    "declaredAt": { "type": "string", "format": "date-time" }
+  },
+  "$defs": {
+    "target": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["kind", "locator", "identity", "ref", "environment"],
+      "properties": {
+        "kind": { "enum": ["file", "directory", "repository", "ref", "artifact", "environment", "profile-source", "other"] },
+        "locator": { "type": "string", "minLength": 1 },
+        "identity": { "type": ["string", "null"] },
+        "ref": { "type": ["string", "null"] },
+        "environment": { "type": ["string", "null"] }
+      }
+    }
+  }
+}

package/contracts/operation-grant-v1.schema.json

@@ -0,0 +1,83 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://forgerail.dev/schemas/operation-grant-v1.json",
+  "title": "ForgeRail Operation Grant v1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schemaVersion", "grantId", "grantDigest", "authorityRequirementId", "workspaceIdentityId", "envelopeId", "envelopeRevisionId", "executorId", "operation", "target", "subjectId", "candidateId", "scope", "issuerId", "issuerEvidenceId", "issuedAt", "notBefore", "expiresAt", "status", "invalidatedAt", "invalidationEvidenceId", "supersededByGrantId", "retroactiveEffect"],
+  "properties": {
+    "schemaVersion": { "const": "1.0" },
+    "grantId": { "type": "string", "pattern": "^[a-zA-Z0-9][a-zA-Z0-9._:-]+$" },
+    "grantDigest": { "type": "string", "pattern": "^[0-9a-f]{64}$" },
+    "authorityRequirementId": { "type": "string", "pattern": "^[a-zA-Z0-9][a-zA-Z0-9._:-]+$" },
+    "workspaceIdentityId": { "type": "string", "pattern": "^[a-zA-Z0-9][a-zA-Z0-9._:-]+$" },
+    "envelopeId": { "type": "string", "pattern": "^[a-zA-Z0-9][a-zA-Z0-9._:-]+$" },
+    "envelopeRevisionId": { "type": "string", "pattern": "^[a-zA-Z0-9][a-zA-Z0-9._:-]+$" },
+    "executorId": { "type": "string", "minLength": 1 },
+    "operation": { "type": "string", "minLength": 1 },
+    "target": { "$ref": "#/$defs/target" },
+    "subjectId": { "type": "string", "pattern": "^[a-zA-Z0-9][a-zA-Z0-9._:-]+$" },
+    "candidateId": { "type": ["string", "null"], "pattern": "^[a-zA-Z0-9][a-zA-Z0-9._:-]+$" },
+    "scope": { "type": "array", "items": { "type": "string", "minLength": 1 }, "minItems": 1, "uniqueItems": true },
+    "issuerId": { "type": "string", "minLength": 1 },
+    "issuerEvidenceId": { "type": "string", "pattern": "^[a-zA-Z0-9][a-zA-Z0-9._:-]+$" },
+    "issuedAt": { "type": "string", "format": "date-time" },
+    "notBefore": { "type": "string", "format": "date-time" },
+    "expiresAt": { "type": "string", "format": "date-time" },
+    "status": { "enum": ["current", "expired", "revoked", "stale", "superseded"] },
+    "invalidatedAt": { "type": ["string", "null"], "format": "date-time" },
+    "invalidationEvidenceId": { "type": ["string", "null"], "pattern": "^[a-zA-Z0-9][a-zA-Z0-9._:-]+$" },
+    "supersededByGrantId": { "type": ["string", "null"], "pattern": "^[a-zA-Z0-9][a-zA-Z0-9._:-]+$" },
+    "retroactiveEffect": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["applies", "scope"],
+      "properties": {
+        "applies": { "type": "boolean" },
+        "scope": { "type": "array", "items": { "type": "string", "minLength": 1 }, "uniqueItems": true }
+      }
+    }
+  },
+  "$defs": {
+    "target": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["kind", "locator", "identity", "ref", "environment"],
+      "properties": {
+        "kind": { "enum": ["file", "directory", "repository", "ref", "artifact", "environment", "profile-source", "other"] },
+        "locator": { "type": "string", "minLength": 1 },
+        "identity": { "type": ["string", "null"] },
+        "ref": { "type": ["string", "null"] },
+        "environment": { "type": ["string", "null"] }
+      }
+    }
+  },
+  "allOf": [
+    {
+      "if": { "properties": { "status": { "const": "current" } }, "required": ["status"] },
+      "then": {
+        "properties": {
+          "invalidatedAt": { "const": null },
+          "invalidationEvidenceId": { "const": null },
+          "supersededByGrantId": { "const": null }
+        }
+      }
+    },
+    {
+      "if": { "properties": { "status": { "const": "superseded" } }, "required": ["status"] },
+      "then": { "properties": { "supersededByGrantId": { "type": "string" } } }
+    },
+    {
+      "if": { "properties": { "status": { "enum": ["expired", "revoked", "stale", "superseded"] } }, "required": ["status"] },
+      "then": { "properties": { "invalidatedAt": { "type": "string", "format": "date-time" } } }
+    },
+    {
+      "if": { "properties": { "status": { "enum": ["revoked", "stale", "superseded"] } }, "required": ["status"] },
+      "then": { "properties": { "invalidationEvidenceId": { "type": "string" } } }
+    },
+    {
+      "if": { "properties": { "retroactiveEffect": { "properties": { "applies": { "const": true } }, "required": ["applies"] } }, "required": ["retroactiveEffect"] },
+      "then": { "properties": { "retroactiveEffect": { "properties": { "scope": { "minItems": 1 } } } } }
+    }
+  ]
+}

package/contracts/phase-slice-correlation-v1.schema.json

@@ -0,0 +1,20 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://forgerail.dev/schemas/phase-slice-correlation-v1.json",
+  "title": "ForgeRail Phase Slice Correlation v1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schemaVersion", "correlationId", "taskId", "parentTaskId", "phaseId", "sliceId", "executionAttemptId", "ownerWorkspaceIdentityId", "requiredSliceIds", "aggregateClosureClaim"],
+  "properties": {
+    "schemaVersion": { "const": "1.0" },
+    "correlationId": { "type": "string", "pattern": "^[a-zA-Z0-9][a-zA-Z0-9._:-]+$" },
+    "taskId": { "type": "string", "pattern": "^[a-zA-Z0-9][a-zA-Z0-9._:-]+$" },
+    "parentTaskId": { "type": ["string", "null"], "pattern": "^[a-zA-Z0-9][a-zA-Z0-9._:-]+$" },
+    "phaseId": { "type": "string", "pattern": "^[a-zA-Z0-9][a-zA-Z0-9._:-]+$" },
+    "sliceId": { "type": "string", "pattern": "^[a-zA-Z0-9][a-zA-Z0-9._:-]+$" },
+    "executionAttemptId": { "type": "string", "pattern": "^[a-zA-Z0-9][a-zA-Z0-9._:-]+$" },
+    "ownerWorkspaceIdentityId": { "type": "string", "pattern": "^[a-zA-Z0-9][a-zA-Z0-9._:-]+$" },
+    "requiredSliceIds": { "type": "array", "items": { "type": "string", "pattern": "^[a-zA-Z0-9][a-zA-Z0-9._:-]+$" }, "minItems": 1, "uniqueItems": true },
+    "aggregateClosureClaim": { "const": false }
+  }
+}