@logicsrc/schemas 0.1.0

package/schemas/logicsrc-opencontext-manifest.schema.json

@@ -0,0 +1,337 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://logicsrc.com/schemas/opencontext/manifest.schema.json",
+  "title": "OpenContext Manifest",
+  "description": "The root manifest of an OpenContext repository, canonically named opencontext.yaml (opencontext.json is also permitted). It declares which context exists, where it is loaded from, who may read it, how authority is ranked, how freshness is judged, and which audit events are recorded. The manifest is a control plane: it points at systems that remain the sources of truth, and is not itself the database.",
+  "type": "object",
+  "required": ["opencontext", "id"],
+  "additionalProperties": false,
+  "properties": {
+    "opencontext": {
+      "type": "string",
+      "pattern": "^\\d+\\.\\d+(\\.\\d+)?$",
+      "description": "OpenContext specification version this manifest conforms to, e.g. '1.0'. Implementations MUST refuse a major version they do not support rather than guess."
+    },
+    "id": {
+      "type": "string",
+      "pattern": "^[a-z0-9][a-z0-9-]*$",
+      "description": "Stable identifier for this context namespace, e.g. 'acme'. Object ids are unique within it."
+    },
+    "name": {
+      "type": "string",
+      "minLength": 1,
+      "description": "Human-readable name of the organization or project this context belongs to."
+    },
+    "description": {
+      "type": "string",
+      "description": "One-paragraph summary of what this context repository covers."
+    },
+    "context": {
+      "type": "object",
+      "description": "Named single-document context entries. Each key becomes a resolvable object id; each value is a path or URI. Example: mission: ./context/mission.md",
+      "additionalProperties": { "type": "string", "minLength": 1 },
+      "propertyNames": { "$ref": "#/$defs/segment" }
+    },
+    "collections": {
+      "type": "object",
+      "description": "Named globs or URIs that expand to many context objects. The key namespaces the ids of everything the collection loads, so ./context/policies/refunds.md under the 'policies' collection becomes policies.refunds unless the document declares its own id.",
+      "additionalProperties": {
+        "anyOf": [
+          { "type": "string", "minLength": 1 },
+          { "$ref": "#/$defs/collectionSpec" }
+        ]
+      },
+      "propertyNames": { "$ref": "#/$defs/segment" }
+    },
+    "roles": {
+      "type": "object",
+      "description": "Named scopes. A role declares which context its holders may read, which context is denied, and which capabilities they hold. Deny always overrides allow.",
+      "additionalProperties": { "$ref": "#/$defs/role" },
+      "propertyNames": { "$ref": "#/$defs/segment" }
+    },
+    "agents": {
+      "type": "object",
+      "description": "Named consumers mapped to the roles they hold. An agent's scope is the union of its roles' includes minus the union of their excludes; an agent holds no context rights of its own.",
+      "additionalProperties": { "$ref": "#/$defs/agentBinding" },
+      "propertyNames": { "$ref": "#/$defs/segment" }
+    },
+    "authority": {
+      "type": "object",
+      "additionalProperties": false,
+      "description": "How competing objects are ranked. Precedence MAY be overridden but MUST remain a permutation of the standard authority levels — a repository cannot invent a level that outranks canonical.",
+      "properties": {
+        "precedence": {
+          "type": "array",
+          "minItems": 1,
+          "uniqueItems": true,
+          "items": { "$ref": "#/$defs/authority" },
+          "description": "Highest authority first. Default: canonical, approved, reference, observed, inferred, historical."
+        },
+        "tie_breakers": {
+          "type": "array",
+          "uniqueItems": true,
+          "items": { "type": "string", "enum": ["version", "updated", "created", "confidence", "id"] },
+          "description": "Applied in order when two candidates remain tied after authority and supersession. Default: version, updated, confidence, id. Resolution appends id as a final total tie breaker so the outcome is always deterministic."
+        }
+      }
+    },
+    "freshness": {
+      "type": "object",
+      "additionalProperties": false,
+      "description": "Defaults for lifecycle evaluation. Per-object metadata always wins over these defaults.",
+      "properties": {
+        "default_ttl": {
+          "$ref": "#/$defs/duration",
+          "description": "How long an object stays 'current' after its updated timestamp before it is reported 'stale', e.g. '30d'. Staleness is a warning: stale context is still resolved, and still flagged."
+        },
+        "stale_is_error": {
+          "type": "boolean",
+          "default": false,
+          "description": "When true, --strict treats stale context as a failure rather than a warning."
+        },
+        "exclude_expired": {
+          "type": "boolean",
+          "default": true,
+          "description": "When true (default), expired objects are excluded from resolution unless historical context is explicitly requested."
+        }
+      }
+    },
+    "provenance": {
+      "type": "object",
+      "additionalProperties": false,
+      "description": "Provenance policy. When required, every resolved object MUST carry a source or declare itself canonical source material.",
+      "properties": {
+        "required": { "type": "boolean", "default": false, "description": "Require every resolved object to be attributable." },
+        "digest": { "type": "string", "enum": ["sha256"], "default": "sha256", "description": "Digest algorithm for source integrity and bundle digests." },
+        "require_digest": { "type": "boolean", "default": false, "description": "Require every declared remote source to carry an integrity digest." }
+      }
+    },
+    "audit": {
+      "type": "object",
+      "additionalProperties": false,
+      "description": "Which events implementations should record. The specification defines the event shape; it does not mandate a storage backend.",
+      "properties": {
+        "context_reads": { "type": "boolean", "default": false },
+        "context_writes": { "type": "boolean", "default": false },
+        "decisions": { "type": "boolean", "default": false },
+        "conflicts": { "type": "boolean", "default": false },
+        "sink": { "type": "string", "description": "Optional URI the reference implementation appends audit events to, e.g. file://./context/.audit/events.ndjson" }
+      }
+    },
+    "redact": {
+      "type": "array",
+      "description": "Repository-wide redaction rules, applied after authorization and before compilation.",
+      "items": { "$ref": "#/$defs/redaction" }
+    },
+    "review": {
+      "$ref": "#/$defs/review",
+      "description": "Default review cadence for objects that do not declare their own."
+    },
+    "adapters": {
+      "type": "object",
+      "description": "URI schemes this repository expects to resolve, mapped to adapter configuration. A scheme no installed adapter claims MUST fail clearly rather than silently resolve to nothing.",
+      "additionalProperties": { "$ref": "#/$defs/adapterConfig" },
+      "propertyNames": { "type": "string", "pattern": "^[a-z][a-z0-9+.-]*$" }
+    },
+    "defaults": {
+      "type": "object",
+      "additionalProperties": false,
+      "description": "Field defaults applied to objects that omit them. Defaults describe house style; they never launder authority, and an implementation MUST NOT default observed or inferred content to canonical.",
+      "properties": {
+        "layer": { "$ref": "#/$defs/layer" },
+        "authority": { "$ref": "#/$defs/authority" },
+        "classification": { "$ref": "#/$defs/classification" },
+        "durability": { "$ref": "#/$defs/durability" },
+        "trust": { "$ref": "#/$defs/trust" },
+        "owner": { "type": "string", "minLength": 1 },
+        "ttl": { "$ref": "#/$defs/duration" }
+      }
+    },
+    "health": {
+      "type": "object",
+      "additionalProperties": false,
+      "description": "Configuration for `opencontext doctor`. The score formula is documented and configurable so a CI threshold means the same thing across repositories.",
+      "properties": {
+        "minimum_score": { "type": "number", "minimum": 0, "maximum": 100, "description": "Doctor exits non-zero below this score when --strict is set." },
+        "weights": {
+          "type": "object",
+          "description": "Per-diagnostic-code weight overriding the documented default. Deductions are weight x affected objects, normalised by object count.",
+          "additionalProperties": { "type": "number", "minimum": 0 },
+          "propertyNames": { "type": "string", "pattern": "^[a-z][a-z0-9-]*$" }
+        },
+        "fail_on": { "$ref": "#/$defs/severity", "description": "Lowest severity that fails a strict run. Default: error." },
+        "require_owner": { "type": "boolean", "default": false, "description": "Treat objects with no owner as an error rather than a warning." }
+      }
+    },
+    "related": {
+      "type": "object",
+      "additionalProperties": false,
+      "description": "Optional links to sibling LogicSRC specifications. These integrations MUST remain optional: OpenContext is independently usable without either of them.",
+      "properties": {
+        "prd": { "type": "string", "description": "Path or URI of an OpenPRD document or collection." },
+        "topology": { "type": "string", "description": "Path or URI of an OpenTopology manifest." },
+        "ontology": { "type": "string", "description": "Path or URI of an OpenOntology package." }
+      }
+    },
+    "extensions": { "$ref": "#/$defs/extensions" }
+  },
+  "$defs": {
+    "segment": {
+      "type": "string",
+      "pattern": "^[a-z0-9][a-z0-9_-]*$",
+      "description": "A single dotted-id segment: lowercase alphanumerics, dashes, underscores."
+    },
+    "duration": {
+      "type": "string",
+      "pattern": "^\\d+(ms|s|m|h|d|w|y)$",
+      "description": "A duration such as '30d', '12h', or '180d'. Units are fixed lengths: y = 365d, w = 7d, d = 24h."
+    },
+    "layer": {
+      "type": "string",
+      "enum": ["L0", "L1", "L2", "L3", "L4", "L5"],
+      "description": "L0 mission, L1 identity, L2 knowledge, L3 policy, L4 procedure, L5 operational."
+    },
+    "authority": {
+      "type": "string",
+      "enum": ["canonical", "approved", "reference", "observed", "inferred", "historical"],
+      "description": "Declared truth level, highest to lowest by default."
+    },
+    "trust": {
+      "type": "string",
+      "enum": ["trusted", "verified", "untrusted"],
+      "description": "Whether the content originated inside the trust boundary."
+    },
+    "durability": {
+      "type": "string",
+      "enum": ["ephemeral", "session", "operational", "long-lived", "permanent"]
+    },
+    "classification": {
+      "type": "string",
+      "enum": ["public", "internal", "confidential", "restricted"]
+    },
+    "severity": {
+      "type": "string",
+      "enum": ["info", "warning", "error"]
+    },
+    "collectionSpec": {
+      "type": "object",
+      "required": ["source"],
+      "additionalProperties": false,
+      "description": "A collection declared with options rather than as a bare glob string.",
+      "properties": {
+        "source": { "type": "string", "minLength": 1, "description": "Glob or URI the collection loads from." },
+        "type": { "type": "string", "pattern": "^[a-z][a-z0-9-]*$", "description": "Default object type for members that omit one." },
+        "layer": { "$ref": "#/$defs/layer" },
+        "authority": { "$ref": "#/$defs/authority" },
+        "classification": { "$ref": "#/$defs/classification" },
+        "durability": { "$ref": "#/$defs/durability" },
+        "trust": { "$ref": "#/$defs/trust" },
+        "owner": { "type": "string", "minLength": 1 },
+        "ttl": { "$ref": "#/$defs/duration" }
+      }
+    },
+    "role": {
+      "type": "object",
+      "additionalProperties": false,
+      "description": "A named scope. Relevance and authorization are different questions: include says what is in scope, and nothing in scope is returned if a deny, an exclusion, or a classification ceiling says otherwise.",
+      "properties": {
+        "description": { "type": "string" },
+        "include": {
+          "type": "array",
+          "uniqueItems": true,
+          "items": { "$ref": "#/$defs/pattern" },
+          "description": "Id patterns in scope, e.g. mission, products.*, policies.support.*. A role with no include sees nothing."
+        },
+        "exclude": {
+          "type": "array",
+          "uniqueItems": true,
+          "items": { "$ref": "#/$defs/pattern" },
+          "description": "Id patterns denied. Applied before relevance ranking and unconditionally overriding include."
+        },
+        "permissions": {
+          "type": "array",
+          "uniqueItems": true,
+          "items": { "type": "string", "minLength": 1 },
+          "description": "Capability strings such as customer.read or ticket.write. OpenContext carries these; it does not enforce your application's actions."
+        },
+        "max_classification": {
+          "$ref": "#/$defs/classification",
+          "description": "Highest classification this role may read. Objects above it are denied even when included. Defaults to internal."
+        },
+        "redact": {
+          "type": "array",
+          "description": "Redaction rules applied to everything this role reads.",
+          "items": { "$ref": "#/$defs/redaction" }
+        },
+        "inherits": {
+          "type": "array",
+          "uniqueItems": true,
+          "items": { "$ref": "#/$defs/segment" },
+          "description": "Roles whose scope is merged into this one. Includes union; excludes and redactions also union, so inheriting can only ever narrow what is readable."
+        },
+        "extensions": { "$ref": "#/$defs/extensions" }
+      }
+    },
+    "pattern": {
+      "type": "string",
+      "minLength": 1,
+      "pattern": "^([a-z0-9][a-z0-9_-]*|\\*)(\\.([a-z0-9][a-z0-9_-]*|\\*))*$",
+      "description": "An exact object id, a trailing wildcard such as policies.support.* covering that subtree, an interior wildcard such as customers.*.churn-risk matching exactly one segment, or * for everything. Wildcards match whole segments only."
+    },
+    "agentBinding": {
+      "type": "object",
+      "required": ["roles"],
+      "additionalProperties": false,
+      "properties": {
+        "roles": {
+          "type": "array",
+          "minItems": 1,
+          "uniqueItems": true,
+          "items": { "$ref": "#/$defs/segment" },
+          "description": "Roles this agent holds. A role named here that the manifest does not define is a validation error."
+        },
+        "description": { "type": "string" },
+        "extensions": { "$ref": "#/$defs/extensions" }
+      }
+    },
+    "adapterConfig": {
+      "type": "object",
+      "additionalProperties": true,
+      "description": "Adapter options. Unknown keys are passed through to the adapter, which validates them.",
+      "properties": {
+        "enabled": { "type": "boolean", "default": true },
+        "package": { "type": "string", "description": "Module implementing the adapter contract for this scheme." },
+        "offline": { "type": "boolean", "description": "When true this adapter is skipped in --offline runs instead of failing them." },
+        "trust": { "$ref": "#/$defs/trust", "description": "Trust applied to content this adapter returns when the object does not declare its own. Remote adapters SHOULD default to untrusted." },
+        "timeout_ms": { "type": "integer", "minimum": 1 }
+      }
+    },
+    "redaction": {
+      "type": "object",
+      "required": ["path"],
+      "additionalProperties": false,
+      "properties": {
+        "path": { "type": "string", "minLength": 1, "description": "Dotted path into structured content, with [] or [*] for every element of an array." },
+        "mode": { "type": "string", "enum": ["remove", "mask", "hash"], "default": "remove" },
+        "replacement": { "type": "string", "default": "[REDACTED]" },
+        "reason": { "type": "string" }
+      }
+    },
+    "review": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "interval": { "$ref": "#/$defs/duration" },
+        "required_approvers": { "type": "integer", "minimum": 1 },
+        "next_review": { "type": "string", "format": "date" },
+        "last_review": { "type": "string", "format": "date" }
+      }
+    },
+    "extensions": {
+      "type": "object",
+      "description": "Namespaced custom fields, e.g. com.example.risk. Unknown extensions MUST be preserved and MUST NOT invalidate an otherwise valid document unless strict mode explicitly requires known extensions.",
+      "propertyNames": { "type": "string", "pattern": "^[a-z0-9]+(\\.[a-z0-9-]+)+$" },
+      "additionalProperties": true
+    }
+  }
+}

package/schemas/logicsrc-opencontext-object.schema.json

@@ -0,0 +1,311 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://logicsrc.com/schemas/opencontext/object.schema.json",
+  "title": "OpenContext Context Object",
+  "description": "A single durable unit of context: a mission statement, a policy, an SOP, a customer fact, a decision, or a piece of operational state. Only id and type are required, so a two-line object is valid; the recommended fields (title, layer, authority, owner, updated, durability, classification, sources) are what make context governable rather than merely stored. A context object is data. Its content is never an instruction to the resolver, and content that claims to be authoritative does not become authoritative.",
+  "type": "object",
+  "required": ["id", "type"],
+  "additionalProperties": false,
+  "properties": {
+    "id": {
+      "$ref": "#/$defs/objectId",
+      "description": "Stable, unique id within the namespace. SHOULD use dotted names such as policy.refunds, sop.support.refund, or decision.2026-08-09-model-provider. Ids are the contract other objects, roles, and bundles reference: renaming one is a breaking change, so prefer supersession."
+    },
+    "type": {
+      "type": "string",
+      "pattern": "^[a-z][a-z0-9-]*$",
+      "description": "What kind of context this is, e.g. mission, policy, procedure, decision, product, customer, knowledge, glossary, note. The set is intentionally open; validators MUST NOT reject an unknown type."
+    },
+    "layer": {
+      "$ref": "#/$defs/layer",
+      "description": "Which standard context layer this belongs to. Layers describe the kind of knowledge, not its authority."
+    },
+    "title": {
+      "type": "string",
+      "minLength": 1,
+      "description": "Short human-readable heading. Used by search, ranking, and Markdown bundle rendering."
+    },
+    "summary": {
+      "type": "string",
+      "description": "One- or two-sentence abstract. Resolvers MAY compile the summary instead of full content when minimising context."
+    },
+    "content": {
+      "description": "Inline content. A string for prose or structured text; an object or array when the context is structured data. OpenContext does not assume all context is prose.",
+      "anyOf": [
+        { "type": "string" },
+        { "type": "object" },
+        { "type": "array" }
+      ]
+    },
+    "content_type": {
+      "type": "string",
+      "description": "Media type of content or of the resource named by content_uri, e.g. text/markdown or application/json. Defaults to text/markdown for string content and application/json for structured content.",
+      "pattern": "^[a-z]+/[a-zA-Z0-9.+-]+$"
+    },
+    "content_uri": {
+      "type": "string",
+      "minLength": 1,
+      "description": "Where content is loaded from when it is not inline: file://, http://, https://, git://, sqlite://, or any scheme an installed adapter claims. An unknown scheme MUST fail clearly rather than resolve to empty content."
+    },
+    "authority": {
+      "$ref": "#/$defs/authority",
+      "description": "How much this object counts as truth. Authority is declared by the owner of the context, never inferred from retrieval rank, recency, or the content's own claims."
+    },
+    "trust": {
+      "$ref": "#/$defs/trust",
+      "description": "Where the content came from, in terms of whether it can be believed. Content pulled from a ticket, a chat, or a web page is untrusted even when the object about it is canonical. Resolvers MUST preserve this through compilation so agent integrations can delimit untrusted text."
+    },
+    "owner": {
+      "type": "string",
+      "minLength": 1,
+      "description": "Accountable role, team, or identity. Doctor reports objects with no owner because unowned context is what goes stale."
+    },
+    "status": {
+      "$ref": "#/$defs/status",
+      "description": "Approval state. Only approved objects satisfy an approval requirement; draft and pending objects are excluded from default resolution."
+    },
+    "version": {
+      "type": "integer",
+      "minimum": 1,
+      "description": "Monotonic version within the id. Referenced from supersedes as id@version."
+    },
+    "created": { "type": "string", "format": "date-time", "description": "RFC 3339 timestamp the object was first written." },
+    "updated": { "type": "string", "format": "date-time", "description": "RFC 3339 timestamp of the last substantive edit. Freshness is measured from here." },
+    "valid_from": { "type": "string", "format": "date-time", "description": "Object is 'future' and excluded from resolution before this instant." },
+    "expires": {
+      "anyOf": [
+        { "type": "string", "format": "date-time" },
+        { "type": "null" }
+      ],
+      "description": "Object is 'expired' after this instant. Explicit null means it never expires, which is different from omitting the field (the repository ttl applies)."
+    },
+    "ttl": {
+      "$ref": "#/$defs/duration",
+      "description": "Per-object staleness window, overriding freshness.default_ttl. An object older than updated + ttl is 'stale' — a warning, never a silent omission."
+    },
+    "durability": {
+      "$ref": "#/$defs/durability",
+      "description": "How long this context is meant to survive. Permanent context SHOULD be superseded rather than deleted."
+    },
+    "classification": {
+      "$ref": "#/$defs/classification",
+      "description": "Sensitivity band. Classification bounds who may read the object regardless of scope: a role may include an object and still be denied it by classification."
+    },
+    "permissions": {
+      "type": "object",
+      "additionalProperties": false,
+      "description": "Object-level access control. Deny always overrides allow, and permissions are evaluated before relevance ranking, so an unauthorised object never reaches a prompt.",
+      "properties": {
+        "read": { "$ref": "#/$defs/principalList", "description": "Roles or agents that may read this object. Absent means the repository scope rules decide." },
+        "write": { "$ref": "#/$defs/principalList", "description": "Roles or agents that may modify or supersede it." },
+        "deny": { "$ref": "#/$defs/principalList", "description": "Roles or agents explicitly denied, overriding any include or read grant." }
+      }
+    },
+    "redact": {
+      "type": "array",
+      "description": "Redaction rules applied to this object's structured content after authorization.",
+      "items": { "$ref": "#/$defs/redaction" }
+    },
+    "sources": {
+      "type": "array",
+      "description": "Where this context came from. Required for every resolved object when provenance.required is true, unless canonical_source is true. Provenance MUST survive bundle compilation.",
+      "items": { "$ref": "#/$defs/source" }
+    },
+    "canonical_source": {
+      "type": "boolean",
+      "default": false,
+      "description": "True when this object is itself the origin of the fact and has no upstream source. Satisfies a provenance requirement on its own."
+    },
+    "supersedes": {
+      "type": "array",
+      "uniqueItems": true,
+      "items": { "$ref": "#/$defs/objectRef" },
+      "description": "Objects this one replaces, as id or id@version. Superseded objects are excluded from default resolution but retained, so history can be reconstructed."
+    },
+    "superseded_by": {
+      "$ref": "#/$defs/objectRef",
+      "description": "Set on the older object when a chain is written explicitly rather than inferred. A chain that points at a missing object is a broken supersession error."
+    },
+    "conflicts_with": {
+      "type": "array",
+      "uniqueItems": true,
+      "items": { "$ref": "#/$defs/objectRef" },
+      "description": "Objects known to contradict this one. Declared conflicts between canonical objects are reported, never silently resolved."
+    },
+    "references": {
+      "type": "array",
+      "uniqueItems": true,
+      "items": { "$ref": "#/$defs/objectRef" },
+      "description": "Other context this object depends on or cites. Drives the graph and orphan detection."
+    },
+    "depends_on": {
+      "type": "array",
+      "uniqueItems": true,
+      "items": { "$ref": "#/$defs/objectRef" },
+      "description": "Context that must resolve alongside this object for it to make sense. Resolvers SHOULD pull dependencies in when the object is selected and the consumer is authorised for them."
+    },
+    "applies_to": {
+      "type": "array",
+      "uniqueItems": true,
+      "items": { "type": "string", "minLength": 1 },
+      "description": "Roles, agents, products, or scopes this object is specifically about. Used to rank task relevance and to keep irrelevant context out of a bundle."
+    },
+    "confidence": {
+      "type": "number",
+      "minimum": 0,
+      "maximum": 1,
+      "description": "How sure the owner is, from 0 to 1. Confidence breaks ties within an authority level; it never promotes an object across levels."
+    },
+    "tags": {
+      "type": "array",
+      "uniqueItems": true,
+      "items": { "type": "string", "minLength": 1 },
+      "description": "Free-form labels for search and scope matching."
+    },
+    "approval": {
+      "type": "object",
+      "additionalProperties": false,
+      "description": "Approval requirements. The specification defines the metadata and states; it does not require a hosted approval workflow.",
+      "properties": {
+        "required": { "type": "boolean", "default": false },
+        "roles": { "type": "array", "uniqueItems": true, "items": { "type": "string", "minLength": 1 }, "description": "Roles entitled to approve." },
+        "minimum": { "type": "integer", "minimum": 1, "description": "How many approvals are needed. Defaults to 1 when required is true." },
+        "approved_by": {
+          "type": "array",
+          "items": { "$ref": "#/$defs/approver" },
+          "description": "Approvals recorded so far. Fewer than minimum leaves the object unapproved, which doctor reports."
+        }
+      }
+    },
+    "review": {
+      "type": "object",
+      "additionalProperties": false,
+      "description": "Review cadence for durable context that must not be allowed to rot quietly.",
+      "properties": {
+        "interval": { "$ref": "#/$defs/duration" },
+        "required_approvers": { "type": "integer", "minimum": 1 },
+        "next_review": { "type": "string", "format": "date" },
+        "last_review": { "type": "string", "format": "date" }
+      }
+    },
+    "language": { "type": "string", "description": "BCP 47 tag of the content language, e.g. 'en'." },
+    "extensions": { "$ref": "#/$defs/extensions" }
+  },
+  "$defs": {
+    "objectId": {
+      "type": "string",
+      "pattern": "^[a-z0-9][a-z0-9_-]*(\\.[a-z0-9][a-z0-9_-]*)*$",
+      "maxLength": 512,
+      "description": "Dotted lowercase id. Segments are alphanumerics, dashes, and underscores."
+    },
+    "objectRef": {
+      "type": "string",
+      "pattern": "^[a-z0-9][a-z0-9_-]*(\\.[a-z0-9][a-z0-9_-]*)*(@\\d+)?$",
+      "maxLength": 520,
+      "description": "An object id, optionally pinned to a version with @N."
+    },
+    "layer": {
+      "type": "string",
+      "enum": ["L0", "L1", "L2", "L3", "L4", "L5"],
+      "description": "L0 mission (why the organization exists), L1 identity (brand, values, terminology), L2 knowledge (products, customers, architecture, facts), L3 policy (rules, permissions, compliance), L4 procedure (SOPs, workflows, playbooks), L5 operational (tasks, incidents, temporary state)."
+    },
+    "authority": {
+      "type": "string",
+      "enum": ["canonical", "approved", "reference", "observed", "inferred", "historical"],
+      "description": "canonical = the organization's own source of truth; approved = reviewed and sanctioned; reference = useful but not binding; observed = seen in the wild, unverified; inferred = derived by a model or heuristic; historical = retained for the record only. Observed and inferred context never becomes canonical automatically."
+    },
+    "trust": {
+      "type": "string",
+      "enum": ["trusted", "verified", "untrusted"],
+      "description": "trusted = authored inside the trust boundary; verified = external but integrity-checked; untrusted = arrived from a system that can carry attacker-controlled text. Default for content fetched by a remote adapter is untrusted."
+    },
+    "durability": {
+      "type": "string",
+      "enum": ["ephemeral", "session", "operational", "long-lived", "permanent"],
+      "description": "How long the context is expected to matter, from a single exchange through to organizational record."
+    },
+    "classification": {
+      "type": "string",
+      "enum": ["public", "internal", "confidential", "restricted"],
+      "description": "Sensitivity band, least to most sensitive."
+    },
+    "status": {
+      "type": "string",
+      "enum": ["draft", "pending", "approved", "rejected", "retired"],
+      "description": "Approval lifecycle state. Distinct from the computed freshness state (future, current, stale, expired, superseded)."
+    },
+    "duration": {
+      "type": "string",
+      "pattern": "^\\d+(ms|s|m|h|d|w|y)$",
+      "description": "A duration such as '30d' or '12h'. y = 365d, w = 7d, d = 24h."
+    },
+    "principalList": {
+      "type": "array",
+      "uniqueItems": true,
+      "items": { "type": "string", "minLength": 1 },
+      "description": "Role names, agent ids, or '*' for everyone. Matching is exact except for a trailing .* wildcard."
+    },
+    "redaction": {
+      "type": "object",
+      "required": ["path"],
+      "additionalProperties": false,
+      "description": "A rule removing or masking part of an object's structured content before it reaches a bundle.",
+      "properties": {
+        "path": {
+          "type": "string",
+          "minLength": 1,
+          "description": "Dotted path into the object's content, with [] or [*] for every element of an array, e.g. customer.ssn or contacts[*].email."
+        },
+        "mode": {
+          "type": "string",
+          "enum": ["remove", "mask", "hash"],
+          "default": "remove",
+          "description": "remove deletes the key; mask replaces the value with the replacement string; hash replaces it with a sha256 digest so equality is still testable without disclosure."
+        },
+        "replacement": { "type": "string", "default": "[REDACTED]", "description": "Text used by mask mode." },
+        "reason": { "type": "string", "description": "Why the field is redacted. Surfaced in --explain." }
+      }
+    },
+    "source": {
+      "type": "object",
+      "required": ["uri"],
+      "additionalProperties": false,
+      "description": "One origin of this context. Sources make a claim attributable; they do not make it authoritative.",
+      "properties": {
+        "uri": { "type": "string", "minLength": 1, "description": "Where the context came from, e.g. git://github.com/acme/context/policies/refunds.md or crm://pricing/enterprise." },
+        "type": { "type": "string", "description": "What kind of origin this is, e.g. canonical-record, document, conversation, observation, api." },
+        "retrieved_at": { "type": "string", "format": "date-time", "description": "When the content was last read from this source." },
+        "digest": {
+          "type": "string",
+          "pattern": "^(sha256):[0-9a-f]{64}$",
+          "description": "Integrity digest of the retrieved bytes, as sha256:<64 lowercase hex>. Lets a consumer detect that a remote source changed under them."
+        },
+        "label": { "type": "string", "description": "Human-readable name of the source." },
+        "trust": { "$ref": "#/$defs/trust", "description": "Trust of this specific origin, when it differs from the object's." }
+      }
+    },
+    "approver": {
+      "type": "object",
+      "additionalProperties": false,
+      "description": "One recorded approval.",
+      "properties": {
+        "role": { "type": "string", "minLength": 1 },
+        "id": { "type": "string", "minLength": 1, "description": "Identity of the approver, e.g. an email or DID." },
+        "at": { "type": "string", "format": "date-time" }
+      },
+      "anyOf": [
+        { "required": ["role"], "properties": { "role": { "type": "string" } } },
+        { "required": ["id"], "properties": { "id": { "type": "string" } } }
+      ]
+    },
+    "extensions": {
+      "type": "object",
+      "description": "Namespaced custom fields, e.g. com.example.risk. Unknown extensions MUST be preserved through resolution and MUST NOT invalidate an otherwise valid document unless strict mode explicitly requires known extensions.",
+      "propertyNames": {
+        "type": "string",
+        "pattern": "^[a-z0-9]+(\\.[a-z0-9-]+)+$"
+      },
+      "additionalProperties": true
+    }
+  }
+}