@marinjursic/prc-linux-arm64 0.1.0 → 0.2.0

package/DISCLOSURE

@@ -0,0 +1,21 @@
+Production Readiness Checklist is a defensive, read-only assessment tool for
+software projects that the user owns or is authorized to inspect.
+
+The scanner includes security-related capabilities that can resemble dual-use
+security tooling. It can identify exposed-secret patterns with bundled,
+version-pinned Gitleaks rules. With an explicit verify-local capability grant,
+it can invoke pinned Gitleaks, Syft, Grype, or Checkov container images against
+local project files. It can also prepare bounded project context for an
+explicitly selected Codex or Claude review. These features are intended to help
+maintainers find production-readiness gaps in their own software.
+
+The default scan does not change project files, install project dependencies,
+run project lifecycle scripts, exploit a target, upload project contents, or
+contact external analyzers. External adapters are opt-in, use exact manifests
+and pinned inputs, and are designed to run without network access. AI review is
+opt-in and advisory; it cannot create a verified pass.
+
+The package contains no exploit payloads and is not intended for unauthorized
+access, credential collection, persistence, evasion, or harm. Users are
+responsible for scanning only projects and systems they are authorized to
+assess.

package/README.md

@@ -1,3 +1,7 @@
 # Production Readiness Checklist native package
 
-This internal platform package is installed automatically by `@marinjursic/prc`. Install and invoke the launcher package instead of depending on this package directly.
+This is one operating-system and CPU build of the native `prc` scanner. It is an internal package installed automatically by `@marinjursic/prc`; install and invoke the launcher instead of depending on this package directly.
+
+The package has no npm dependencies and no install, update, or lifecycle scripts. It does not download a binary after installation. The launcher selects the exact package for the current machine, verifies the release-bound manifest, checks the SHA-256 and size of the native executable and every runtime support file, and fails closed if anything is missing or changed.
+
+A normal scan reads a user-selected project and writes a private report outside that project. It does not fix project files, install project dependencies, or run project scripts. Security analyzers and Codex or Claude review require explicit opt-in. See the launcher package and project documentation for installation, supported commands, the dual-use disclosure, checksums, SBOM, and provenance information.

package/bin/catalog/assertions/core-repository.yaml

@@ -2,16 +2,16 @@ schema_version: prc.assertions/v0.1
 catalog_version: 1.0.0
 assertions:
   - id: PRC-A-CORE-001
-    revision: 2
+    revision: 3
     control_ids: [USEQ-FDCA6C71]
     title: README is present
-    statement: A nonempty README file exists at the repository root.
+    statement: A README file containing non-whitespace UTF-8 text exists at the repository root.
     applicability: "true"
     evidence_required:
       - kind: repository-file
         minimum_authority: repository
-        description: A nonempty root README file from the scanned commit.
-    implementation_id: prc.native.file-present@0.1
+        description: A root README containing non-whitespace UTF-8 text from the scanned commit.
+    implementation_id: prc.native.file-present@0.2
     parameters:
       paths: [README.md, README.rst, README.txt]
       minimum_bytes: 1
@@ -19,16 +19,16 @@ assertions:
     gate: required
     remediation_class: R2
   - id: PRC-A-CORE-002
-    revision: 1
+    revision: 2
     control_ids: [USEQ-6497B434]
     title: License is present
-    statement: A nonempty license file exists at the repository root.
+    statement: A license file containing non-whitespace UTF-8 text exists at the repository root.
     applicability: "true"
     evidence_required:
       - kind: repository-file
         minimum_authority: repository
-        description: A nonempty root license file from the scanned commit.
-    implementation_id: prc.native.file-present@0.1
+        description: A root license file containing non-whitespace UTF-8 text from the scanned commit.
+    implementation_id: prc.native.file-present@0.2
     parameters:
       paths: [LICENSE, LICENSE.md, LICENSE.txt, COPYING]
       minimum_bytes: 1
@@ -36,16 +36,16 @@ assertions:
     gate: required
     remediation_class: R0
   - id: PRC-A-CORE-003
-    revision: 1
+    revision: 2
     control_ids: [USEQ-89F5E97A]
     title: Contribution guidance is present
-    statement: A nonempty contribution guide exists at the repository root.
+    statement: A contribution guide containing non-whitespace UTF-8 text exists at the repository root.
     applicability: "true"
     evidence_required:
       - kind: repository-file
         minimum_authority: repository
-        description: A nonempty root contribution guide from the scanned commit.
-    implementation_id: prc.native.file-present@0.1
+        description: A root contribution guide containing non-whitespace UTF-8 text from the scanned commit.
+    implementation_id: prc.native.file-present@0.2
     parameters:
       paths: [CONTRIBUTING.md, CONTRIBUTING.rst]
       minimum_bytes: 1
@@ -53,16 +53,16 @@ assertions:
     gate: advisory
     remediation_class: R0
   - id: PRC-A-CORE-004
-    revision: 1
+    revision: 2
     control_ids: [USEQ-AC6AC548]
     title: Security policy is present
-    statement: A nonempty security policy exists at the repository root.
+    statement: A security policy containing non-whitespace UTF-8 text exists at the repository root.
     applicability: "true"
     evidence_required:
       - kind: repository-file
         minimum_authority: repository
-        description: A nonempty root security policy from the scanned commit.
-    implementation_id: prc.native.file-present@0.1
+        description: A root security policy containing non-whitespace UTF-8 text from the scanned commit.
+    implementation_id: prc.native.file-present@0.2
     parameters:
       paths: [SECURITY.md, docs/SECURITY.md]
       minimum_bytes: 1
@@ -70,16 +70,16 @@ assertions:
     gate: required
     remediation_class: R0
   - id: PRC-A-CORE-005
-    revision: 1
+    revision: 2
     control_ids: [USEQ-D73106BF]
     title: Code of conduct is present
-    statement: A nonempty code-of-conduct document exists at the repository root.
+    statement: A code-of-conduct document containing non-whitespace UTF-8 text exists at the repository root.
     applicability: "true"
     evidence_required:
       - kind: repository-file
         minimum_authority: repository
-        description: A nonempty root code-of-conduct document from the scanned commit.
-    implementation_id: prc.native.file-present@0.1
+        description: A root code-of-conduct document containing non-whitespace UTF-8 text from the scanned commit.
+    implementation_id: prc.native.file-present@0.2
     parameters:
       paths: [CODE_OF_CONDUCT.md, CODE_OF_CONDUCT.rst]
       minimum_bytes: 1
@@ -87,16 +87,16 @@ assertions:
     gate: advisory
     remediation_class: R0
   - id: PRC-A-CORE-006
-    revision: 1
+    revision: 2
     control_ids: [USEQ-CA602113]
     title: Code ownership is declared
-    statement: A nonempty CODEOWNERS file exists in a supported repository location.
+    statement: A CODEOWNERS file containing non-whitespace UTF-8 text exists in a supported repository location.
     applicability: "true"
     evidence_required:
       - kind: repository-file
         minimum_authority: repository
-        description: A nonempty CODEOWNERS file from the scanned commit.
-    implementation_id: prc.native.file-present@0.1
+        description: A CODEOWNERS file containing non-whitespace UTF-8 text from the scanned commit.
+    implementation_id: prc.native.file-present@0.2
     parameters:
       paths: [.github/CODEOWNERS, CODEOWNERS, docs/CODEOWNERS]
       minimum_bytes: 1
@@ -244,16 +244,16 @@ assertions:
     gate: required
     remediation_class: R0
   - id: PRC-A-CORE-016
-    revision: 1
+    revision: 2
     control_ids: [PRC-36-011]
     title: Dependency updates are configured
-    statement: A supported dependency-update automation configuration is present.
+    statement: A supported dependency-update automation configuration containing non-whitespace UTF-8 text is present.
     applicability: inventory.package_ecosystems.size() > 0
     evidence_required:
       - kind: repository-file
         minimum_authority: repository
-        description: A nonempty supported dependency-update configuration.
-    implementation_id: prc.native.file-present@0.1
+        description: A supported dependency-update configuration containing non-whitespace UTF-8 text.
+    implementation_id: prc.native.file-present@0.2
     parameters:
       paths: [.github/dependabot.yml, .github/dependabot.yaml, renovate.json, renovate.json5, .renovaterc, .renovaterc.json]
       minimum_bytes: 1

package/bin/fixtures/benchmarks/core-native/suite-comprehensive.yaml

@@ -1,5 +1,5 @@
 schema_version: prc.benchmark-suite/v0.2
-id: prc.benchmark.core-native@1.0
+id: prc.benchmark.core-native@1.1
 title: Comprehensive core native assertion benchmark
 profile_id: prc/core-repository
 cases:
@@ -78,6 +78,15 @@ cases:
     target: targets/readme-missing
     expectations:
       - {assertion_id: PRC-A-CORE-001, assessment: fail, execution: completed}
+  - id: readme-whitespace
+    target: targets/baseline
+    setup:
+      - operation: replace_text
+        path: README.md
+        find: "# Benchmark baseline\n\nThis fixture exercises repository, inapplicable, manual, and blocked outcomes.\n"
+        replace: "\uFEFF\u00A0\u2003\n"
+    expectations:
+      - {assertion_id: PRC-A-CORE-001, assessment: fail, execution: completed}
   - id: test-declaration-valid
     target: targets/test-declaration-valid
     expectations:

package/bin/fixtures/benchmarks/core-native/suite.yaml

@@ -1,5 +1,5 @@
-schema_version: prc.benchmark-suite/v0.1
-id: prc.benchmark.core-native@0.1
+schema_version: prc.benchmark-suite/v0.2
+id: prc.benchmark.core-native@0.2
 title: Core native assertion benchmark
 profile_id: prc/core-repository
 cases:
@@ -39,6 +39,17 @@ cases:
       - assertion_id: PRC-A-CORE-001
         assessment: fail
         execution: completed
+  - id: readme-whitespace
+    target: targets/baseline
+    setup:
+      - operation: replace_text
+        path: README.md
+        find: "# Benchmark baseline\n\nThis fixture exercises repository, inapplicable, manual, and blocked outcomes.\n"
+        replace: "\uFEFF\u00A0\u2003\n"
+    expectations:
+      - assertion_id: PRC-A-CORE-001
+        assessment: fail
+        execution: completed
   - id: workflow-malformed
     target: targets/workflow-malformed
     expectations:

package/bin/packs/core-foundation.yaml

@@ -1,5 +1,5 @@
 schema_version: prc.pack/v0.1
-id: prc.pack.core-foundation@0.1
+id: prc.pack.core-foundation@0.2
 title: Core repository validated foundation
 description: A small, measured foundation of deterministic repository checks.
 publisher_id: prc-project
@@ -8,7 +8,7 @@ engine_apis: [prc.engine/v0.1]
 profile_ids: [prc/core-repository]
 assertions:
   - assertion_id: PRC-A-CORE-001
-    implementation_id: prc.native.file-present@0.1
+    implementation_id: prc.native.file-present@0.2
     validated_outcomes: [pass, fail]
   - assertion_id: PRC-A-CORE-007
     implementation_id: prc.native.dependency-lock@0.1
@@ -17,9 +17,9 @@ assertions:
     implementation_id: prc.native.github-workflow-valid@0.1
     validated_outcomes: [pass, not_applicable, error]
 benchmark:
-  suite_id: prc.benchmark.core-native@0.1
+  suite_id: prc.benchmark.core-native@0.2
   suite_path: fixtures/benchmarks/core-native/suite.yaml
-  suite_sha256: 208c180313d0bd0b13d09eaca040eb967fb6664f205b283841f386b9cacd2e7d
+  suite_sha256: 06a20e9bf344e4a1684043f6a90a1aed714eca4efc59a015d84e890e5acd5395
 limitations:
   - The pack covers only three native assertions and is not the complete core profile.
   - The initial fixtures do not establish cross-platform or large-repository performance.

package/bin/packs/core-native.yaml

@@ -1,5 +1,5 @@
 schema_version: prc.pack/v0.1
-id: prc.pack.core-native@1.0
+id: prc.pack.core-native@1.1
 title: Core native assertion pack
 description: Catalog-wide deterministic checks measured against the comprehensive core fixture corpus.
 publisher_id: prc-project
@@ -7,12 +7,12 @@ maintenance: active
 engine_apis: [prc.engine/v0.1]
 profile_ids: [prc/core-repository, prc/api, prc/kubernetes]
 assertions:
-  - {assertion_id: PRC-A-CORE-001, implementation_id: prc.native.file-present@0.1, validated_outcomes: [pass, fail]}
-  - {assertion_id: PRC-A-CORE-002, implementation_id: prc.native.file-present@0.1, validated_outcomes: [pass, fail]}
-  - {assertion_id: PRC-A-CORE-003, implementation_id: prc.native.file-present@0.1, validated_outcomes: [pass, fail]}
-  - {assertion_id: PRC-A-CORE-004, implementation_id: prc.native.file-present@0.1, validated_outcomes: [pass, fail]}
-  - {assertion_id: PRC-A-CORE-005, implementation_id: prc.native.file-present@0.1, validated_outcomes: [pass, fail]}
-  - {assertion_id: PRC-A-CORE-006, implementation_id: prc.native.file-present@0.1, validated_outcomes: [pass, fail]}
+  - {assertion_id: PRC-A-CORE-001, implementation_id: prc.native.file-present@0.2, validated_outcomes: [pass, fail]}
+  - {assertion_id: PRC-A-CORE-002, implementation_id: prc.native.file-present@0.2, validated_outcomes: [pass, fail]}
+  - {assertion_id: PRC-A-CORE-003, implementation_id: prc.native.file-present@0.2, validated_outcomes: [pass, fail]}
+  - {assertion_id: PRC-A-CORE-004, implementation_id: prc.native.file-present@0.2, validated_outcomes: [pass, fail]}
+  - {assertion_id: PRC-A-CORE-005, implementation_id: prc.native.file-present@0.2, validated_outcomes: [pass, fail]}
+  - {assertion_id: PRC-A-CORE-006, implementation_id: prc.native.file-present@0.2, validated_outcomes: [pass, fail]}
   - {assertion_id: PRC-A-CORE-007, implementation_id: prc.native.dependency-lock@0.1, validated_outcomes: [pass, fail, not_applicable]}
   - {assertion_id: PRC-A-CORE-008, implementation_id: prc.native.github-action-pin@0.1, validated_outcomes: [pass, fail, not_applicable]}
   - {assertion_id: PRC-A-CORE-009, implementation_id: prc.native.ci-present@0.1, validated_outcomes: [pass, fail]}
@@ -22,7 +22,7 @@ assertions:
   - {assertion_id: PRC-A-CORE-013, implementation_id: prc.native.analysis-evidence@0.1, validated_outcomes: [blocked]}
   - {assertion_id: PRC-A-CORE-014, implementation_id: prc.native.final-newline@0.1, validated_outcomes: [pass, fail]}
   - {assertion_id: PRC-A-CORE-015, implementation_id: prc.native.git-revision@0.1, validated_outcomes: [pass, fail]}
-  - {assertion_id: PRC-A-CORE-016, implementation_id: prc.native.file-present@0.1, validated_outcomes: [pass, fail, not_applicable]}
+  - {assertion_id: PRC-A-CORE-016, implementation_id: prc.native.file-present@0.2, validated_outcomes: [pass, fail, not_applicable]}
   - {assertion_id: PRC-A-CORE-017, implementation_id: prc.native.github-workflow-valid@0.1, validated_outcomes: [pass, not_applicable, error]}
   - {assertion_id: PRC-A-CORE-018, implementation_id: prc.native.github-workflow-jobs@0.1, validated_outcomes: [pass, fail, not_applicable, error]}
   - {assertion_id: PRC-A-CORE-019, implementation_id: prc.native.github-workflow-timeouts@0.1, validated_outcomes: [pass, fail, not_applicable, error]}
@@ -48,9 +48,9 @@ assertions:
   - {assertion_id: PRC-A-K8S-003, implementation_id: prc.native.kubernetes-capabilities@0.1, validated_outcomes: [pass, fail, not_applicable]}
   - {assertion_id: PRC-A-K8S-004, implementation_id: prc.native.kubernetes-seccomp@0.1, validated_outcomes: [pass, fail, not_applicable]}
 benchmark:
-  suite_id: prc.benchmark.core-native@1.0
+  suite_id: prc.benchmark.core-native@1.1
   suite_path: fixtures/benchmarks/core-native/suite-comprehensive.yaml
-  suite_sha256: 1035fef3034185344a18bbf3e308143418f1b0bbd7f1fdd0a71a8adc138c9968
+  suite_sha256: 532a5828a6e283d38ddcdbae71fdbbfd03159128067e5a8037dac3f6a36ac4b3
 limitations:
   - Manual-review and adapter-backed assertions are validated only in their fail-closed manual or blocked states.
   - OpenAPI operation checks cover direct path and webhook operations; referenced Path Items, callbacks, multi-document descriptions, and referenced responses require a future bounded resolver or adapter.

package/bin/schemas/adapter-execution-v0.3.schema.json

@@ -0,0 +1,145 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://marinjursic.github.io/production-readiness-checklist/schemas/adapter-execution-v0.3.schema.json",
+  "title": "Bound Production Readiness Adapter Execution v0.3",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schema_version", "execution_id", "adapter_run_id", "adapter_id", "manifest_sha256", "image", "resolution", "data_inputs", "subject", "started_at", "completed_at", "duration_ms", "diagnostics_sha256", "diagnostics_bytes", "transcript"],
+  "properties": {
+    "schema_version": {"const": "prc.adapter-execution/v0.3"},
+    "execution_id": {"type": "string", "pattern": "^[0-9a-f]{64}$"},
+    "adapter_run_id": {"type": "string", "pattern": "^[0-9a-f]{64}$"},
+    "adapter_id": {"type": "string", "pattern": "^prc\\.adapter\\.[a-z0-9.-]+@[0-9]+\\.[0-9]+$"},
+    "manifest_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"},
+    "image": {"type": "string", "pattern": "^.+@sha256:[0-9a-f]{64}$"},
+    "resolution": {"$ref": "#/$defs/resolution"},
+    "data_inputs": {
+      "type": "array",
+      "maxItems": 16,
+      "items": {"$ref": "#/$defs/data_input"}
+    },
+    "subject": {"$ref": "#/$defs/subject"},
+    "started_at": {"type": "string", "format": "date-time"},
+    "completed_at": {"type": "string", "format": "date-time"},
+    "duration_ms": {"type": "integer", "minimum": 0},
+    "diagnostics_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"},
+    "diagnostics_bytes": {"type": "integer", "minimum": 0},
+    "transcript": {"$ref": "#/$defs/transcript"}
+  },
+  "$defs": {
+    "data_input": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["name", "destination", "sha256", "files", "bytes"],
+      "properties": {
+        "name": {"type": "string", "pattern": "^[a-z0-9][a-z0-9.-]{0,127}$"},
+        "destination": {"type": "string", "pattern": "^/prc-inputs/[a-z0-9][a-z0-9.-]{0,127}$"},
+        "sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"},
+        "files": {"type": "integer", "minimum": 1},
+        "bytes": {"type": "integer", "minimum": 1}
+      }
+    },
+    "resolution": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["source", "publisher_id", "trust"],
+      "properties": {
+        "source": {"enum": ["explicit-local", "registry"]},
+        "publisher_id": {"type": "string", "pattern": "^[a-z0-9][a-z0-9.-]{0,127}$"},
+        "trust": {"enum": ["local-explicit", "first-party-sandboxed", "verified-community", "unverified-community", "local"]},
+        "registry_id": {"type": "string", "pattern": "^prc\\.adapter-registry\\.[a-z0-9.-]+@[0-9]+\\.[0-9]+$"},
+        "registry_revision": {"type": "integer", "minimum": 1},
+        "registry_digest": {"type": "string", "pattern": "^[0-9a-f]{64}$"}
+      },
+      "allOf": [
+        {
+          "if": {"properties": {"source": {"const": "registry"}}},
+          "then": {
+            "required": ["registry_id", "registry_revision", "registry_digest"],
+            "properties": {"trust": {"enum": ["first-party-sandboxed", "verified-community", "unverified-community", "local"]}}
+          },
+          "else": {
+            "properties": {"trust": {"const": "local-explicit"}},
+            "not": {"anyOf": [{"required": ["registry_id"]}, {"required": ["registry_revision"]}, {"required": ["registry_digest"]}]}
+          }
+        }
+      ]
+    },
+    "subject": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["target_name", "inventory_digest"],
+      "properties": {
+        "target_name": {"type": "string", "minLength": 1},
+        "target_commit": {"type": "string", "pattern": "^[0-9a-f]{40,64}$"},
+        "inventory_digest": {"type": "string", "pattern": "^[0-9a-f]{64}$"}
+      }
+    },
+    "location": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["path"],
+      "properties": {
+        "path": {"type": "string", "minLength": 1},
+        "line": {"type": "integer", "minimum": 0},
+        "column": {"type": "integer", "minimum": 0}
+      }
+    },
+    "observation": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["id", "kind", "outcome", "summary", "locations"],
+      "properties": {
+        "id": {"type": "string", "minLength": 1},
+        "kind": {"type": "string", "minLength": 1},
+        "outcome": {"enum": ["found", "not_found", "value", "unsupported"]},
+        "summary": {"type": "string", "minLength": 1},
+        "locations": {"type": "array", "items": {"$ref": "#/$defs/location"}},
+        "data": {"type": "object"}
+      }
+    },
+    "artifact": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["id", "media_type", "digest", "size"],
+      "properties": {
+        "id": {"type": "string", "minLength": 1},
+        "media_type": {"type": "string", "minLength": 1},
+        "digest": {"type": "string", "pattern": "^sha256:[0-9a-f]{64}$"},
+        "size": {"type": "integer", "minimum": 0},
+        "path": {"type": "string", "minLength": 1}
+      }
+    },
+    "log": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["level", "message"],
+      "properties": {
+        "level": {"enum": ["debug", "info", "warning", "error"]},
+        "message": {"type": "string", "minLength": 1}
+      }
+    },
+    "summary": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["status", "counts"],
+      "properties": {
+        "status": {"enum": ["completed", "partial", "unsupported", "configuration_error", "execution_error", "timeout", "parse_error"]},
+        "counts": {"type": "object", "additionalProperties": {"type": "integer", "minimum": 0}},
+        "reason": {"type": "string", "minLength": 1}
+      },
+      "allOf": [{"if": {"properties": {"status": {"not": {"const": "completed"}}}}, "then": {"required": ["reason"]}}]
+    },
+    "transcript": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["logs", "observations", "artifacts", "summary"],
+      "properties": {
+        "logs": {"type": "array", "items": {"$ref": "#/$defs/log"}},
+        "observations": {"type": "array", "items": {"$ref": "#/$defs/observation"}},
+        "artifacts": {"type": "array", "items": {"$ref": "#/$defs/artifact"}},
+        "summary": {"$ref": "#/$defs/summary"}
+      }
+    }
+  }
+}

package/bin/schemas/authoritative-evidence-bundle.schema.json

@@ -0,0 +1,38 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://marinjursic.github.io/production-readiness-checklist/schemas/authoritative-evidence-bundle.schema.json",
+  "title": "Production Readiness Authoritative Evidence Bundle v0.1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schema_version", "id", "catalog_sha256", "inventory_sha256", "authority", "entries"],
+  "properties": {
+    "schema_version": {"const": "prc.authoritative-evidence-bundle/v0.1"},
+    "id": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9./@_-]{0,255}$"},
+    "catalog_sha256": {"$ref": "#/$defs/digest"},
+    "inventory_sha256": {"$ref": "#/$defs/digest"},
+    "authority": {"$ref": "#/$defs/authority"},
+    "entries": {
+      "type": "array",
+      "minItems": 1,
+      "maxItems": 765,
+      "items": {"$ref": "#/$defs/entry"}
+    }
+  },
+  "$defs": {
+    "digest": {"type": "string", "pattern": "^[0-9a-f]{64}$"},
+    "authority": {
+      "enum": ["repository", "artifact", "executed", "environment", "external_registry", "structured_record"]
+    },
+    "entry": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["template_id", "provider_id", "program", "evidence"],
+      "properties": {
+        "template_id": {"$ref": "#/$defs/digest"},
+        "provider_id": {"type": "string", "pattern": "^[a-z0-9][a-z0-9._/@:-]{0,255}$"},
+        "program": {"$ref": "control-check-program.schema.json"},
+        "evidence": {"$ref": "control-check-evidence.schema.json"}
+      }
+    }
+  }
+}

package/bin/schemas/authoritative-evidence-set.schema.json

@@ -0,0 +1,38 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://marinjursic.github.io/production-readiness-checklist/schemas/authoritative-evidence-set.schema.json",
+  "title": "Production Readiness Authoritative Evidence Set v0.1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schema_version", "trust_store_file", "bundles"],
+  "properties": {
+    "schema_version": {"const": "prc.authoritative-evidence-set/v0.1"},
+    "trust_store_file": {"$ref": "#/$defs/file_name"},
+    "bundles": {
+      "type": "array",
+      "minItems": 1,
+      "maxItems": 6,
+      "items": {"$ref": "#/$defs/bundle"}
+    }
+  },
+  "$defs": {
+    "file_name": {
+      "type": "string",
+      "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$"
+    },
+    "authority": {
+      "enum": ["artifact", "environment", "executed", "external_registry", "repository", "structured_record"]
+    },
+    "bundle": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["authority", "bundle_file", "policy_signature_file", "evidence_signature_file"],
+      "properties": {
+        "authority": {"$ref": "#/$defs/authority"},
+        "bundle_file": {"$ref": "#/$defs/file_name"},
+        "policy_signature_file": {"$ref": "#/$defs/file_name"},
+        "evidence_signature_file": {"$ref": "#/$defs/file_name"}
+      }
+    }
+  }
+}

package/bin/schemas/authoritative-evidence-verification.schema.json

@@ -0,0 +1,54 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://marinjursic.github.io/production-readiness-checklist/schemas/authoritative-evidence-verification.schema.json",
+  "title": "Production Readiness Authoritative Evidence Verification v0.1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schema_version", "bundle_id", "bundle_sha256", "policy_sha256", "catalog_sha256", "inventory_sha256",
+    "authority", "entry_count", "entries", "policy_signature", "evidence_signature"
+  ],
+  "properties": {
+    "schema_version": {"const": "prc.authoritative-evidence-verification/v0.1"},
+    "bundle_id": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9./@_-]{0,255}$"},
+    "bundle_sha256": {"$ref": "#/$defs/digest"},
+    "policy_sha256": {"$ref": "#/$defs/digest"},
+    "catalog_sha256": {"$ref": "#/$defs/digest"},
+    "inventory_sha256": {"$ref": "#/$defs/digest"},
+    "authority": {
+      "enum": ["repository", "artifact", "executed", "environment", "external_registry", "structured_record"]
+    },
+    "entry_count": {"type": "integer", "minimum": 1, "maximum": 765},
+    "entries": {
+      "type": "array",
+      "minItems": 1,
+      "maxItems": 765,
+      "items": {"$ref": "#/$defs/entry"}
+    },
+    "policy_signature": {"$ref": "signature-verification.schema.json"},
+    "evidence_signature": {"$ref": "signature-verification.schema.json"}
+  },
+  "$defs": {
+    "digest": {"type": "string", "pattern": "^[0-9a-f]{64}$"},
+    "entry": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["template_id", "provider_id", "program", "evidence_sha256", "outcome", "reason_code"],
+      "properties": {
+        "template_id": {"$ref": "#/$defs/digest"},
+        "provider_id": {"type": "string", "pattern": "^[a-z0-9][a-z0-9._/@:-]{0,255}$"},
+        "program": {"$ref": "control-check-program.schema.json"},
+        "evidence_sha256": {"$ref": "#/$defs/digest"},
+        "outcome": {"enum": ["pass", "fail", "blocked", "not_applicable"]},
+        "reason_code": {
+          "enum": [
+            "passed", "predicate_false", "not_applicable", "invalid_program", "invalid_evidence",
+            "evidence_binding_mismatch", "wrong_authority", "evidence_stale", "evidence_from_future",
+            "evidence_incomplete", "evidence_conflicting", "applicability_unknown",
+            "not_applicable_disallowed", "applicability_proof_missing", "fact_missing", "fact_type_mismatch"
+          ]
+        }
+      }
+    }
+  }
+}

package/bin/schemas/automatic-coverage.schema.json

@@ -0,0 +1,49 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://marinjursic.github.io/production-readiness-checklist/schemas/automatic-coverage.schema.json",
+  "title": "Production Readiness Automatic Coverage v0.1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schema_version", "control_count", "reviewed_routing_control_count",
+    "deterministic_control_count", "nondeterministic_control_count", "advisory_ai_review_control_count", "exact_clause_count",
+    "exact_predicate_clause_count", "built_in_collector_clause_count",
+    "signed_import_supported_clause_count", "authorities"
+  ],
+  "properties": {
+    "schema_version": {"const": "prc.automatic-coverage/v0.1"},
+    "control_count": {"type": "integer", "minimum": 1},
+    "reviewed_routing_control_count": {"type": "integer", "minimum": 0},
+    "deterministic_control_count": {"type": "integer", "minimum": 0},
+    "nondeterministic_control_count": {"type": "integer", "minimum": 0},
+    "advisory_ai_review_control_count": {"type": "integer", "minimum": 0},
+    "exact_clause_count": {"type": "integer", "minimum": 0},
+    "exact_predicate_clause_count": {"type": "integer", "minimum": 0},
+    "built_in_collector_clause_count": {"type": "integer", "minimum": 0},
+    "signed_import_supported_clause_count": {"type": "integer", "minimum": 0},
+    "authorities": {
+      "type": "array",
+      "minItems": 1,
+      "maxItems": 6,
+      "items": {"$ref": "#/$defs/authority"}
+    }
+  },
+  "$defs": {
+    "authority": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "name", "exact_clause_count", "built_in_collector_clause_count",
+        "signed_import_supported_clause_count"
+      ],
+      "properties": {
+        "name": {
+          "enum": ["artifact", "environment", "executed", "external_registry", "repository", "structured_record"]
+        },
+        "exact_clause_count": {"type": "integer", "minimum": 0},
+        "built_in_collector_clause_count": {"type": "integer", "minimum": 0},
+        "signed_import_supported_clause_count": {"type": "integer", "minimum": 0}
+      }
+    }
+  }
+}