@ixo/domain.md 0.3.0

package/assets/oracle-capsule-jcs-vectors.json

@@ -0,0 +1,57 @@
+{
+  "contract": "urn:ixo:domain-md:x-oracle-capsule:jcs-vectors:0.1.0",
+  "standard": "RFC 8785",
+  "input_profile": "I-JSON with safe integers",
+  "exact_bytes_note": "Canonical bytes are used for generated digest and signature surfaces. Artifact CID and SHA-256 values cover exact fetched bytes and MUST NOT be recomputed from parsed or canonicalized content.",
+  "vectors": [
+    {
+      "name": "nested-key-order-and-array-order",
+      "input": "{\"b\":2,\"a\":1,\"nested\":{\"z\":false,\"x\":[3,null,\"ok\"]}}",
+      "canonical": "{\"a\":1,\"b\":2,\"nested\":{\"x\":[3,null,\"ok\"],\"z\":false}}",
+      "sha256": "a070af735949703f6babceafa678b655c2c7023c1391c60b6971f6576f800214"
+    },
+    {
+      "name": "ecmascript-number-serialization",
+      "input": "{\"numbers\":[333333333.33333329,4.50,2e-3,1e-27,-0]}",
+      "canonical": "{\"numbers\":[333333333.3333333,4.5,0.002,1e-27,0]}",
+      "sha256": "d643d0848531ed0c371cd568685f25bfb58064d6e091425152615add4dfba18f"
+    },
+    {
+      "name": "utf16-code-unit-property-order",
+      "input": "{\"1\":\"one\",\"€\":\"Euro\",\"\\r\":\"CR\",\"€\":\"control\",\"ö\":\"latin\",\"😀\":\"emoji\"}",
+      "canonical": "{\"\\r\":\"CR\",\"1\":\"one\",\"€\":\"control\",\"ö\":\"latin\",\"€\":\"Euro\",\"😀\":\"emoji\"}",
+      "sha256": "2edb0589ad42854433550be7f5cae2e1635a304d71d9f6985070faf256a4c97b"
+    },
+    {
+      "name": "json-string-escaping",
+      "input": "{\"text\":\"line\\nquote\\\"slash\\tab\\t\"}",
+      "canonical": "{\"text\":\"line\\nquote\\\"slash\\tab\\t\"}",
+      "sha256": "3183b19961812dafd142dd31a0c989b8539bb9859efa1ce9e8188d16289bb87b"
+    },
+    {
+      "name": "reject-duplicate-object-name",
+      "input": "{\"a\":1,\"a\":2}",
+      "errorCode": "capsule-duplicate-key"
+    },
+    {
+      "name": "reject-lone-surrogate",
+      "input": "{\"x\":\"\\uDEAD\"}",
+      "errorCode": "capsule-unicode"
+    },
+    {
+      "name": "reject-unsafe-integer",
+      "input": "{\"x\":9007199254740992}",
+      "errorCode": "capsule-number"
+    },
+    {
+      "name": "reject-non-finite-overflow",
+      "input": "{\"x\":1e999}",
+      "errorCode": "capsule-number"
+    },
+    {
+      "name": "reject-byte-order-mark",
+      "input": "{}",
+      "errorCode": "capsule-encoding"
+    }
+  ]
+}

package/assets/oracle-capsule-manifest-contract.md

@@ -0,0 +1,72 @@
+<!-- Generated from spec/oracle-capsule.mdx | schema: urn:ixo:domain-md:x-oracle-capsule:manifest:0.1.0 -->
+<!-- Do not edit directly. Run npm run spec:generate. -->
+
+# x-oracle-capsule companion manifest contract
+
+Status: experimental static-conformance contract 0.1.0. The architecture and threat-model decisions remain the source of truth for the trust boundaries behind this schema.
+
+## Scope and authority boundary
+
+The `x-oracle-capsule` binding, companion manifest and source lock describe immutable release bytes. They do not grant authority, select current protocol state, authorize evidence disclosure, approve an outcome, activate a tool, sign a receipt or move value. A static-pass report always returns `externalChecksRequired`; a runtime must resolve those checks from their owning authorities and fail closed when any required verdict is missing, stale, ambiguous or negative.
+
+The portable package is host-neutral. Codex, Claude, Pi, CLI and MCP hosts may supply reasoning and presentation, but cannot reinterpret this contract or become its authority, durable state, secret store, signer or audit ledger.
+
+## Frozen identities
+
+| Surface                 | Frozen value                                           |
+| ----------------------- | ------------------------------------------------------ |
+| Binding key             | `x-oracle-capsule`                                     |
+| `apiVersion`            | `ixo.earth/oracle-capsule/v0alpha1`                    |
+| Manifest `kind`         | `OracleCapsuleRelease`                                 |
+| Manifest schema         | `urn:ixo:domain-md:x-oracle-capsule:manifest:0.1.0`    |
+| Manifest media type     | `application/vnd.ixo.oracle-capsule+json`              |
+| Source-lock `kind`      | `OracleCapsuleSourceLock`                              |
+| Source-lock schema      | `urn:ixo:domain-md:x-oracle-capsule:source-lock:0.1.0` |
+| Source-lock media type  | `application/vnd.ixo.oracle-capsule.source-lock+json`  |
+| Exact-byte digest       | SHA-256                                                |
+| Exact-byte address      | CIDv1, raw codec, sha2-256 multihash                   |
+| Generated serialization | RFC 8785 JSON Canonicalization Scheme (JCS)            |
+
+The schema URI is an identifier, not a network authority. Implementations use the schema packaged with the validator; they must not fetch a mutable replacement.
+
+## `domain.md` binding
+
+The top-level binding contains only `contract` and `manifest`. The manifest URI is immutable only when coupled to both its CID and SHA-256. The CID and SHA-256 cover the exact fetched UTF-8 bytes. The media type, schema URI and release SemVer must match the fetched manifest. Generic `x-*` extension behavior does not weaken this exact binding.
+
+## Manifest ownership
+
+`metadata` owns release identity and supersession history. Supersession does not activate a release. `provenance` pins the repository, commit, builder and exact reviewed architecture/threat-model digests. `compatibility` declares the contract major, minimum kernel, required features and presentation hosts; a runtime may narrow these requirements but never downgrade them.
+
+`domains.oracle` pins the Oracle identity document. `domains.subjects` pins every permitted subject-domain contract. Domain references do not copy or override current controller, right, claim, rubric, evidence, Flow, consent or review state.
+
+`components` contains exactly one required `master_skill`. Every component is immutable, dual-addressed by CID and SHA-256, versioned, owned, update-authority scoped, explicitly required or optional, assigned a disclosure/loading policy, and read-only at runtime. Optional specialist skills, scripts, runtime bundles, policies, rubrics, output schemas, reference-memory snapshots, evaluation suites and host adapters remain bounded components; an unknown required kind fails schema validation. Dependencies must resolve and form an acyclic graph.
+
+The Master artifact references one content-addressed source lock and names a relative entrypoint. It may orchestrate reasoning and request declared tools, but cannot activate a tool, alter authority precedence, modify package bytes, read secrets directly, suppress evidence, approve itself or change a kernel invariant.
+
+`tools` describes requested runtime contracts: DID, version, signed manifest, typed input/output and receipt schemas, risk, side effects, capability actions, sandbox and egress projection. These records are allowlist requests only. `requestedCapabilities` must name a declared tool and remains subject to the effective runtime intersection.
+
+`effectCeiling` can only narrow the identity document, run authorization, live capability, subject policy and runtime policy. Human review remains external and digest-bound.
+
+## Strict parsing and RFC 8785
+
+Manifest, lock, attestation, authority-record and receipt digest/signature surfaces use RFC 8785 JCS after strict I-JSON parsing. Inputs must be UTF-8 without a BOM; object names must be unique; Unicode must contain no lone surrogate; numbers must be finite; integers must be within `[-9007199254740991, 9007199254740991]`; arrays preserve order. Object names are sorted by UTF-16 code units as required by RFC 8785.
+
+The release digest is SHA-256 over JCS of the entire manifest after removing only `metadata.release_digest`. No other field is omitted. The published vectors in `oracle-capsule-jcs-vectors.json` are normative and must run unchanged in every implementation and packed host.
+
+Canonical serialization never substitutes for exact-byte verification. Whitespace-different manifest bytes can produce the same JCS bytes while having different valid exact-byte SHA/CID identities.
+
+## Source locks and extraction
+
+A source lock binds one manifest component to its artifact CID, SHA-256 and byte length, then lists every regular file by unambiguous relative path, byte length and SHA-256. Paths are `/`-separated, relative, non-empty, non-duplicated and contain no backslash, empty segment or `..` segment. Only regular files are permitted. Symbolic/hard links, devices, sockets, absolute paths, traversal, duplicate archive names, case/normalization collisions, undeclared files, missing files and extraction outside a fresh isolated root must fail before execution.
+
+The static in-memory package verifier checks exact locked bytes and refuses unlocked files. Archive readers and network resolvers are downstream runtime surfaces and must additionally enforce redirect, DNS/IP, decompression, total-size, file-count and race-safe extraction controls before presenting bytes to this verifier.
+
+## Stable findings and limits
+
+Strict JSON failures carry a stable `capsule-*` code, JSON Pointer path, and one-based line/column. Schema and semantic findings inherit the closest parsed pointer location. The frozen default budgets are 1 MiB per manifest/lock, depth 64, 10,000 JSON nodes, 10,000 characters per scalar, 10,000 locked files and 64 MiB total locked file bytes. A runtime may choose smaller limits, never larger limits while claiming this contract.
+
+## Static verdict
+
+A `static-pass` proves only local syntax, schema, internal references, release serialization and the exact bytes supplied to the package verifier. It does not prove URI resolution, current identity or subject state, authorization, revocation, trusted time, consent/decryption, human approval, distribution trust or signer trust. These remain explicitly listed as runtime external checks in every report.
+
+Any byte or semantic change creates a new release version and exact-byte CID/SHA. Rollback is an explicit activation decision by the owning authority; it never rewrites history. Existing Blueprint Runtime v0.2 canonical JSON helpers and digest fixtures are unchanged: capsule JCS is a new versioned contract and downstream runtimes must call this implementation or pass its exact vectors before claiming conformance.

package/assets/oracle-capsule-source-lock.schema.json

@@ -0,0 +1,45 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "urn:ixo:domain-md:x-oracle-capsule:source-lock:0.1.0",
+  "title": "IXO Oracle Capsule source lock",
+  "type": "object",
+  "required": ["apiVersion", "kind", "schema", "component", "artifact", "files"],
+  "properties": {
+    "apiVersion": { "const": "ixo.earth/oracle-capsule/v0alpha1" },
+    "kind": { "const": "OracleCapsuleSourceLock" },
+    "schema": { "const": "urn:ixo:domain-md:x-oracle-capsule:source-lock:0.1.0" },
+    "component": { "type": "string", "minLength": 1, "maxLength": 200, "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/-]*$" },
+    "artifact": {
+      "type": "object",
+      "required": ["cid", "sha256", "bytes"],
+      "properties": {
+        "cid": { "$ref": "#/$defs/cid" },
+        "sha256": { "$ref": "#/$defs/sha256" },
+        "bytes": { "type": "integer", "minimum": 0, "maximum": 67108864 }
+      },
+      "additionalProperties": false
+    },
+    "files": {
+      "type": "array",
+      "minItems": 1,
+      "maxItems": 10000,
+      "items": {
+        "type": "object",
+        "required": ["path", "bytes", "sha256", "mode"],
+        "properties": {
+          "path": { "$ref": "#/$defs/relativePath" },
+          "bytes": { "type": "integer", "minimum": 0, "maximum": 67108864 },
+          "sha256": { "$ref": "#/$defs/sha256" },
+          "mode": { "const": "file" }
+        },
+        "additionalProperties": false
+      }
+    }
+  },
+  "additionalProperties": false,
+  "$defs": {
+    "sha256": { "type": "string", "pattern": "^[0-9a-f]{64}$" },
+    "cid": { "type": "string", "pattern": "^b[a-z2-7]{10,}$" },
+    "relativePath": { "type": "string", "minLength": 1, "maxLength": 1024, "pattern": "^(?!/)(?!.*(?:^|/)\\.\\.(?:/|$))(?!.*\\\\)(?!.*//)[A-Za-z0-9._-]+(?:/[A-Za-z0-9._-]+)*$" }
+  }
+}

package/assets/oracle-capsule.schema.json

@@ -0,0 +1,265 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "urn:ixo:domain-md:x-oracle-capsule:manifest:0.1.0",
+  "title": "IXO Oracle Capsule release manifest",
+  "description": "Host-neutral immutable release contract. This manifest requests capabilities but grants no live authority.",
+  "type": "object",
+  "required": [
+    "apiVersion",
+    "kind",
+    "schema",
+    "metadata",
+    "provenance",
+    "compatibility",
+    "domains",
+    "components",
+    "tools",
+    "requestedCapabilities",
+    "effectCeiling",
+    "external_checks_required"
+  ],
+  "properties": {
+    "apiVersion": { "const": "ixo.earth/oracle-capsule/v0alpha1" },
+    "kind": { "const": "OracleCapsuleRelease" },
+    "schema": { "const": "urn:ixo:domain-md:x-oracle-capsule:manifest:0.1.0" },
+    "metadata": {
+      "type": "object",
+      "required": ["name", "release", "created", "issuer", "operator", "release_digest", "supersedes"],
+      "properties": {
+        "name": { "$ref": "#/$defs/name" },
+        "release": { "$ref": "#/$defs/semver" },
+        "created": { "type": "string", "format": "date-time" },
+        "issuer": { "$ref": "#/$defs/did" },
+        "operator": { "$ref": "#/$defs/did" },
+        "release_digest": { "$ref": "#/$defs/sha256" },
+        "supersedes": {
+          "anyOf": [{ "$ref": "#/$defs/cid" }, { "type": "null" }]
+        }
+      },
+      "additionalProperties": false
+    },
+    "provenance": {
+      "type": "object",
+      "required": ["repository", "commit", "builder", "reviewed_contract"],
+      "properties": {
+        "repository": { "$ref": "#/$defs/httpsUri" },
+        "commit": { "type": "string", "pattern": "^[0-9a-f]{40}$" },
+        "builder": { "$ref": "#/$defs/did" },
+        "build_attestation": {
+          "anyOf": [{ "$ref": "#/$defs/artifact" }, { "type": "null" }]
+        },
+        "reviewed_contract": {
+          "type": "object",
+          "required": ["repository", "commit", "architecture_sha256", "threat_model_sha256"],
+          "properties": {
+            "repository": { "$ref": "#/$defs/httpsUri" },
+            "commit": { "type": "string", "pattern": "^[0-9a-f]{40}$" },
+            "architecture_sha256": { "$ref": "#/$defs/sha256" },
+            "threat_model_sha256": { "$ref": "#/$defs/sha256" }
+          },
+          "additionalProperties": false
+        }
+      },
+      "additionalProperties": false
+    },
+    "compatibility": {
+      "type": "object",
+      "required": ["contract_major", "minimum_kernel", "required_features", "hosts"],
+      "properties": {
+        "contract_major": { "const": "v0alpha1" },
+        "minimum_kernel": { "$ref": "#/$defs/semver" },
+        "required_features": { "$ref": "#/$defs/uniqueNames" },
+        "hosts": {
+          "type": "array",
+          "minItems": 1,
+          "uniqueItems": true,
+          "items": { "enum": ["codex", "claude", "pi", "cli", "mcp", "other"] }
+        }
+      },
+      "additionalProperties": false
+    },
+    "domains": {
+      "type": "object",
+      "required": ["oracle", "subjects"],
+      "properties": {
+        "oracle": { "$ref": "#/$defs/domainReference" },
+        "subjects": {
+          "type": "array",
+          "minItems": 1,
+          "items": { "$ref": "#/$defs/domainReference" }
+        }
+      },
+      "additionalProperties": false
+    },
+    "components": {
+      "type": "array",
+      "minItems": 1,
+      "maxItems": 512,
+      "items": { "$ref": "#/$defs/component" },
+      "contains": {
+        "type": "object",
+        "properties": { "kind": { "const": "master_skill" } },
+        "required": ["kind"]
+      },
+      "minContains": 1,
+      "maxContains": 1
+    },
+    "tools": {
+      "type": "array",
+      "maxItems": 256,
+      "items": { "$ref": "#/$defs/tool" }
+    },
+    "requestedCapabilities": {
+      "type": "array",
+      "maxItems": 256,
+      "items": {
+        "type": "object",
+        "required": ["id", "action", "object", "tool"],
+        "properties": {
+          "id": { "$ref": "#/$defs/name" },
+          "action": { "$ref": "#/$defs/name" },
+          "object": { "$ref": "#/$defs/name" },
+          "tool": { "$ref": "#/$defs/name" }
+        },
+        "additionalProperties": false
+      }
+    },
+    "effectCeiling": {
+      "type": "object",
+      "required": ["mode", "allowed", "forbidden", "human_review_required_for"],
+      "properties": {
+        "mode": { "enum": ["read_only", "propose_only", "bounded_evaluate", "bounded_execute"] },
+        "allowed": { "$ref": "#/$defs/uniqueNames" },
+        "forbidden": { "$ref": "#/$defs/uniqueNames" },
+        "human_review_required_for": { "$ref": "#/$defs/uniqueNames" }
+      },
+      "additionalProperties": false
+    },
+    "external_checks_required": {
+      "type": "array",
+      "minItems": 8,
+      "maxItems": 8,
+      "uniqueItems": true,
+      "items": {
+        "enum": [
+          "oracle-identity-current",
+          "subject-domain-current",
+          "capability-current-and-unrevoked",
+          "trusted-time-available",
+          "private-resource-access-authorized",
+          "human-review-authorized",
+          "runtime-distribution-trusted",
+          "receipt-signer-current-and-unrevoked"
+        ]
+      },
+      "allOf": [
+        { "contains": { "const": "oracle-identity-current" } },
+        { "contains": { "const": "capability-current-and-unrevoked" } },
+        { "contains": { "const": "trusted-time-available" } },
+        { "contains": { "const": "runtime-distribution-trusted" } },
+        { "contains": { "const": "receipt-signer-current-and-unrevoked" } }
+      ]
+    }
+  },
+  "additionalProperties": false,
+  "$defs": {
+    "name": { "type": "string", "minLength": 1, "maxLength": 200, "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/-]*$" },
+    "semver": { "type": "string", "pattern": "^(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)(?:-[0-9A-Za-z-]+(?:\\.[0-9A-Za-z-]+)*)?(?:\\+[0-9A-Za-z-]+(?:\\.[0-9A-Za-z-]+)*)?$" },
+    "did": { "type": "string", "pattern": "^did:ixo:[A-Za-z0-9._:%-]+$" },
+    "sha256": { "type": "string", "pattern": "^[0-9a-f]{64}$" },
+    "cid": { "type": "string", "pattern": "^b[a-z2-7]{10,}$" },
+    "httpsUri": { "type": "string", "pattern": "^https://[^/?#]+/[^?#]*$" },
+    "immutableUri": { "type": "string", "pattern": "^(ipfs://b[a-z2-7]{10,}(?:/[^?#]*)?|https://[^/?#]+/[^?#]*|file:[^?#]+)$" },
+    "relativePath": { "type": "string", "minLength": 1, "maxLength": 1024, "pattern": "^(?!/)(?!.*(?:^|/)\\.\\.(?:/|$))(?!.*\\\\)(?!.*//)[A-Za-z0-9._-]+(?:/[A-Za-z0-9._-]+)*$" },
+    "uniqueNames": { "type": "array", "uniqueItems": true, "items": { "$ref": "#/$defs/name" } },
+    "artifact": {
+      "type": "object",
+      "required": ["uri", "cid", "sha256", "media_type", "bytes"],
+      "properties": {
+        "uri": { "$ref": "#/$defs/immutableUri" },
+        "cid": { "$ref": "#/$defs/cid" },
+        "sha256": { "$ref": "#/$defs/sha256" },
+        "media_type": { "type": "string", "pattern": "^[A-Za-z0-9!#$&^_.+-]+/[A-Za-z0-9!#$&^_.+-]+$" },
+        "bytes": { "type": "integer", "minimum": 0, "maximum": 67108864 },
+        "source_lock": { "$ref": "#/$defs/sourceLockReference" }
+      },
+      "additionalProperties": false
+    },
+    "sourceLockReference": {
+      "type": "object",
+      "required": ["uri", "cid", "sha256", "media_type", "bytes"],
+      "properties": {
+        "uri": { "$ref": "#/$defs/immutableUri" },
+        "cid": { "$ref": "#/$defs/cid" },
+        "sha256": { "$ref": "#/$defs/sha256" },
+        "media_type": { "const": "application/vnd.ixo.oracle-capsule.source-lock+json" },
+        "bytes": { "type": "integer", "minimum": 1, "maximum": 1048576 }
+      },
+      "additionalProperties": false
+    },
+    "domainReference": {
+      "type": "object",
+      "required": ["id", "uri", "cid", "sha256", "version"],
+      "properties": {
+        "id": { "$ref": "#/$defs/did" },
+        "uri": { "$ref": "#/$defs/immutableUri" },
+        "cid": { "$ref": "#/$defs/cid" },
+        "sha256": { "$ref": "#/$defs/sha256" },
+        "version": { "type": "string", "minLength": 1, "maxLength": 100 }
+      },
+      "additionalProperties": false
+    },
+    "component": {
+      "type": "object",
+      "required": ["id", "kind", "required", "artifact", "version", "owner", "update_authority", "compatibility", "dependencies", "disclosure", "loading_policy", "runtime_writable"],
+      "properties": {
+        "id": { "$ref": "#/$defs/name" },
+        "kind": { "enum": ["master_skill", "specialist_skill", "runtime_bundle", "script_bundle", "policy", "rubric", "output_schema", "reference_memory", "evaluation_suite", "host_adapter"] },
+        "required": { "type": "boolean" },
+        "artifact": { "$ref": "#/$defs/artifact" },
+        "version": { "$ref": "#/$defs/semver" },
+        "owner": { "$ref": "#/$defs/did" },
+        "update_authority": { "type": "array", "minItems": 1, "uniqueItems": true, "items": { "$ref": "#/$defs/did" } },
+        "compatibility": { "$ref": "#/$defs/uniqueNames" },
+        "dependencies": { "$ref": "#/$defs/uniqueNames" },
+        "disclosure": { "enum": ["public", "authorized_projection", "never_model_visible"] },
+        "loading_policy": { "enum": ["bootstrap", "on_demand", "runtime_only"] },
+        "runtime_writable": { "const": false },
+        "entrypoint": { "$ref": "#/$defs/relativePath" }
+      },
+      "additionalProperties": false,
+      "allOf": [
+        {
+          "if": { "properties": { "kind": { "const": "master_skill" } }, "required": ["kind"] },
+          "then": {
+            "required": ["entrypoint"],
+            "properties": {
+              "required": { "const": true },
+              "loading_policy": { "const": "bootstrap" },
+              "artifact": { "type": "object", "required": ["source_lock"] }
+            }
+          }
+        }
+      ]
+    },
+    "tool": {
+      "type": "object",
+      "required": ["id", "did", "version", "manifest", "input_schema", "output_schema", "risk_tier", "side_effect", "capability", "sandbox", "egress", "receipt_schema"],
+      "properties": {
+        "id": { "$ref": "#/$defs/name" },
+        "did": { "$ref": "#/$defs/did" },
+        "version": { "$ref": "#/$defs/semver" },
+        "manifest": { "$ref": "#/$defs/artifact" },
+        "input_schema": { "$ref": "#/$defs/artifact" },
+        "output_schema": { "$ref": "#/$defs/artifact" },
+        "risk_tier": { "enum": ["low", "moderate", "high", "critical"] },
+        "side_effect": { "enum": ["none", "reversible", "irreversible", "value_movement", "canonical_state"] },
+        "capability": { "type": "object", "required": ["required", "actions"], "properties": { "required": { "const": true }, "actions": { "$ref": "#/$defs/uniqueNames" } }, "additionalProperties": false },
+        "sandbox": { "type": "object", "required": ["network", "filesystem", "secrets"], "properties": { "network": { "enum": ["none", "allowlist"] }, "filesystem": { "enum": ["none", "read_only_projection"] }, "secrets": { "const": "adapter_only" } }, "additionalProperties": false },
+        "egress": { "type": "object", "required": ["destinations", "fields"], "properties": { "destinations": { "$ref": "#/$defs/uniqueNames" }, "fields": { "$ref": "#/$defs/uniqueNames" } }, "additionalProperties": false },
+        "receipt_schema": { "$ref": "#/$defs/artifact" }
+      },
+      "additionalProperties": false
+    }
+  }
+}