@marinjursic/prc-linux-arm64 0.1.0 → 0.2.0

package/bin/schemas/control-review-output.schema.json

@@ -6,7 +6,7 @@
   "additionalProperties": false,
   "required": ["schema_version", "task_id", "reviews"],
   "properties": {
-    "schema_version": {"const": "prc.control-review-output/v0.1"},
+    "schema_version": {"const": "prc.control-review-output/v0.3"},
     "task_id": {"type": "string", "pattern": "^[0-9a-f]{64}$"},
     "reviews": {
       "type": "array",
@@ -15,14 +15,33 @@
       "items": {
         "type": "object",
         "additionalProperties": false,
-        "required": ["control_id", "assessment_candidate", "applicability_candidate", "confidence", "reason", "advice", "evidence", "limitations"],
+        "required": ["control_id", "assessment_candidate", "applicability_candidate", "confidence", "priority", "root_cause", "root_cause_key", "effort", "blast_radius", "reason", "challenge", "risk_if_ignored", "advice", "remediation_steps", "verification_steps", "evidence_needed", "evidence", "limitations"],
         "properties": {
           "control_id": {"type": "string", "pattern": "^(PRC-[0-9]{2}-[0-9]{3}|USEQ-[A-F0-9]{8})$"},
           "assessment_candidate": {"enum": ["advisory_pass_candidate", "advisory_fail_candidate", "needs_evidence", "not_applicable_candidate"]},
           "applicability_candidate": {"enum": ["applicable", "not_applicable", "undetermined"]},
           "confidence": {"enum": ["low", "medium", "high"]},
+          "priority": {"enum": ["critical", "high", "medium", "low", "none"]},
+          "root_cause": {"type": "string", "minLength": 1, "maxLength": 4096},
+          "root_cause_key": {"type": "string", "pattern": "^[a-z0-9][a-z0-9-]{2,79}$"},
+          "effort": {"enum": ["small", "medium", "large", "unknown"]},
+          "blast_radius": {"enum": ["local", "component", "system", "organization", "unknown"]},
           "reason": {"type": "string", "minLength": 1, "maxLength": 16384},
-          "advice": {"type": "string", "maxLength": 16384},
+          "challenge": {"type": "string", "minLength": 1, "maxLength": 16384},
+          "risk_if_ignored": {"type": "string", "minLength": 1, "maxLength": 16384},
+          "advice": {"type": "string", "minLength": 1, "maxLength": 16384},
+          "remediation_steps": {
+            "type": "array", "minItems": 1, "maxItems": 12, "uniqueItems": true,
+            "items": {"type": "string", "minLength": 1, "maxLength": 16384}
+          },
+          "verification_steps": {
+            "type": "array", "minItems": 1, "maxItems": 12, "uniqueItems": true,
+            "items": {"type": "string", "minLength": 1, "maxLength": 16384}
+          },
+          "evidence_needed": {
+            "type": "array", "minItems": 1, "maxItems": 12, "uniqueItems": true,
+            "items": {"type": "string", "minLength": 1, "maxLength": 16384}
+          },
           "evidence": {
             "type": "array",
             "maxItems": 256,

package/bin/schemas/evidence-requirements.schema.json

@@ -0,0 +1,144 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://marinjursic.github.io/production-readiness-checklist/schemas/evidence-requirements.schema.json",
+  "title": "Production Readiness Evidence Requirements v0.1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schema_version", "catalog_sha256", "registry_sha256", "binding_catalog_sha256",
+    "exact_control_count", "exact_clause_count", "selected_control_count", "selected_clause_count",
+    "built_in_collector_count", "missing_collector_count", "signed_import_route_count",
+    "selection", "authorities", "requirements"
+  ],
+  "properties": {
+    "schema_version": {"const": "prc.evidence-requirements/v0.1"},
+    "catalog_sha256": {"$ref": "#/$defs/digest"},
+    "registry_sha256": {"$ref": "#/$defs/digest"},
+    "binding_catalog_sha256": {"$ref": "#/$defs/digest"},
+    "exact_control_count": {"type": "integer", "minimum": 1},
+    "exact_clause_count": {"type": "integer", "minimum": 1},
+    "selected_control_count": {"type": "integer", "minimum": 1},
+    "selected_clause_count": {"type": "integer", "minimum": 1},
+    "built_in_collector_count": {"type": "integer", "minimum": 0},
+    "missing_collector_count": {"type": "integer", "minimum": 0},
+    "signed_import_route_count": {"type": "integer", "minimum": 0},
+    "selection": {"$ref": "#/$defs/selection"},
+    "authorities": {
+      "type": "array",
+      "minItems": 1,
+      "maxItems": 6,
+      "items": {"$ref": "#/$defs/authority_summary"}
+    },
+    "requirements": {
+      "type": "array",
+      "minItems": 1,
+      "maxItems": 765,
+      "items": {"$ref": "#/$defs/requirement"}
+    }
+  },
+  "$defs": {
+    "digest": {"type": "string", "pattern": "^[0-9a-f]{64}$"},
+    "control_id": {"type": "string", "pattern": "^(?:PRC-[0-9]{2}-[0-9]{3}|USEQ-[A-F0-9]{8})$"},
+    "authority": {
+      "enum": ["artifact", "environment", "executed", "external_registry", "repository", "structured_record"]
+    },
+    "fact_type": {
+      "enum": [
+        "identity", "schema", "digest", "state", "string", "boolean", "number", "time", "string_set",
+        "identity_map", "schema_map", "digest_map", "state_map", "string_map", "boolean_map", "number_map",
+        "time_map", "directed_graph"
+      ]
+    },
+    "selection": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["authority", "control_id", "collector_status"],
+      "properties": {
+        "authority": {"type": "string", "pattern": "^(?:|artifact|environment|executed|external_registry|repository|structured_record)$"},
+        "control_id": {"type": "string", "pattern": "^(?:|PRC-[0-9]{2}-[0-9]{3}|USEQ-[A-F0-9]{8})$"},
+        "collector_status": {"enum": ["all", "built_in", "missing"]}
+      }
+    },
+    "authority_summary": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "name", "selected_clause_count", "built_in_collector_count",
+        "missing_collector_count", "signed_import_route_count"
+      ],
+      "properties": {
+        "name": {"$ref": "#/$defs/authority"},
+        "selected_clause_count": {"type": "integer", "minimum": 1},
+        "built_in_collector_count": {"type": "integer", "minimum": 0},
+        "missing_collector_count": {"type": "integer", "minimum": 0},
+        "signed_import_route_count": {"type": "integer", "minimum": 0}
+      }
+    },
+    "fact": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["id", "type", "raw_value_semantics", "source_requirement", "complete_required"],
+      "properties": {
+        "id": {"type": "string", "pattern": "^[A-Za-z0-9_.-]{3,128}$"},
+        "type": {"$ref": "#/$defs/fact_type"},
+        "raw_value_semantics": {"type": "string", "minLength": 1, "maxLength": 4096},
+        "source_requirement": {"type": "string", "minLength": 1, "maxLength": 12000},
+        "complete_required": {"type": "boolean"}
+      }
+    },
+    "parameter": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["id", "type", "origin", "source_requirement"],
+      "properties": {
+        "id": {"type": "string", "pattern": "^[A-Za-z0-9_.-]{3,128}$"},
+        "type": {"$ref": "#/$defs/fact_type"},
+        "origin": {
+          "enum": ["scanner_inventory", "independently_authenticated_policy", "independently_authenticated_context"]
+        },
+        "source_requirement": {"type": "string", "minLength": 1, "maxLength": 12000}
+      }
+    },
+    "requirement": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "template_id", "control_id", "control_revision", "clause_id", "clause_ordinal", "clause_statement",
+        "checker_family", "authority", "implementation_id", "implementation_contract_sha256", "collector_id",
+        "collector_status", "signed_import_supported", "required_sources", "inventory_contract",
+        "normalization_contract", "completeness_contract", "freshness_contract", "facts", "parameters",
+        "requires_inventory_input", "requires_authenticated_policy_input", "requires_authenticated_context_input",
+        "missing_evidence_result"
+      ],
+      "properties": {
+        "template_id": {"$ref": "#/$defs/digest"},
+        "control_id": {"$ref": "#/$defs/control_id"},
+        "control_revision": {"type": "integer", "minimum": 1},
+        "clause_id": {"$ref": "#/$defs/digest"},
+        "clause_ordinal": {"type": "integer", "minimum": 1, "maximum": 50},
+        "clause_statement": {"type": "string", "minLength": 1, "maxLength": 12000},
+        "checker_family": {"type": "string", "pattern": "^[a-z][a-z0-9_]{2,63}$"},
+        "authority": {"$ref": "#/$defs/authority"},
+        "implementation_id": {"type": "string", "pattern": "^prc\\.check\\.[a-z0-9-]+@[0-9]+\\.[0-9]+$"},
+        "implementation_contract_sha256": {"$ref": "#/$defs/digest"},
+        "collector_id": {"type": "string", "pattern": "^prc\\.collect\\.[a-z0-9.-]+@[0-9]+\\.[0-9]+$"},
+        "collector_status": {"enum": ["built_in", "missing"]},
+        "signed_import_supported": {"type": "boolean"},
+        "required_sources": {
+          "type": "array", "minItems": 1, "maxItems": 64,
+          "items": {"type": "string", "minLength": 1, "maxLength": 12000}
+        },
+        "inventory_contract": {"type": "string", "minLength": 1, "maxLength": 12000},
+        "normalization_contract": {"type": "string", "minLength": 1, "maxLength": 12000},
+        "completeness_contract": {"type": "string", "minLength": 1, "maxLength": 12000},
+        "freshness_contract": {"type": "string", "minLength": 1, "maxLength": 12000},
+        "facts": {"type": "array", "minItems": 1, "maxItems": 512, "items": {"$ref": "#/$defs/fact"}},
+        "parameters": {"type": "array", "maxItems": 512, "items": {"$ref": "#/$defs/parameter"}},
+        "requires_inventory_input": {"type": "boolean"},
+        "requires_authenticated_policy_input": {"type": "boolean"},
+        "requires_authenticated_context_input": {"type": "boolean"},
+        "missing_evidence_result": {"const": "blocked"}
+      }
+    }
+  }
+}

package/bin/schemas/evidence-set-verification.schema.json

@@ -0,0 +1,65 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://marinjursic.github.io/production-readiness-checklist/schemas/evidence-set-verification.schema.json",
+  "title": "Production Readiness Evidence Set Verification v0.1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schema_version", "verified_at", "catalog_sha256", "inventory_sha256",
+    "cryptographically_verified", "bundle_count", "entry_count", "outcomes", "authorities"
+  ],
+  "properties": {
+    "schema_version": {"const": "prc.evidence-set-verification/v0.1"},
+    "verified_at": {"type": "string", "format": "date-time"},
+    "catalog_sha256": {"$ref": "#/$defs/digest"},
+    "inventory_sha256": {"$ref": "#/$defs/digest"},
+    "cryptographically_verified": {"const": true},
+    "bundle_count": {"type": "integer", "minimum": 1, "maximum": 6},
+    "entry_count": {"type": "integer", "minimum": 1, "maximum": 765},
+    "outcomes": {"$ref": "#/$defs/outcomes"},
+    "authorities": {
+      "type": "array",
+      "minItems": 1,
+      "maxItems": 6,
+      "items": {"$ref": "#/$defs/authority"}
+    }
+  },
+  "$defs": {
+    "digest": {"type": "string", "pattern": "^[0-9a-f]{64}$"},
+    "identifier": {"type": "string", "minLength": 1, "maxLength": 256},
+    "outcomes": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["passed", "failed", "not_applicable", "blocked"],
+      "properties": {
+        "passed": {"type": "integer", "minimum": 0},
+        "failed": {"type": "integer", "minimum": 0},
+        "not_applicable": {"type": "integer", "minimum": 0},
+        "blocked": {"type": "integer", "minimum": 0}
+      }
+    },
+    "authority": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "authority", "bundle_id", "bundle_sha256", "policy_sha256", "entry_count", "outcomes",
+        "policy_key_id", "evidence_key_id", "trust_store_id", "trust_store_sha256", "signatures_verified"
+      ],
+      "properties": {
+        "authority": {
+          "enum": ["artifact", "environment", "executed", "external_registry", "repository", "structured_record"]
+        },
+        "bundle_id": {"$ref": "#/$defs/identifier"},
+        "bundle_sha256": {"$ref": "#/$defs/digest"},
+        "policy_sha256": {"$ref": "#/$defs/digest"},
+        "entry_count": {"type": "integer", "minimum": 1, "maximum": 765},
+        "outcomes": {"$ref": "#/$defs/outcomes"},
+        "policy_key_id": {"$ref": "#/$defs/identifier"},
+        "evidence_key_id": {"$ref": "#/$defs/identifier"},
+        "trust_store_id": {"$ref": "#/$defs/identifier"},
+        "trust_store_sha256": {"$ref": "#/$defs/digest"},
+        "signatures_verified": {"const": true}
+      }
+    }
+  }
+}

package/bin/schemas/provider-capabilities.schema.json

@@ -0,0 +1,26 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://marinjursic.github.io/production-readiness-checklist/schemas/provider-capabilities.schema.json",
+  "title": "Shipped deterministic evidence providers v0.1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schema_version", "capabilities"],
+  "properties": {
+    "schema_version": {"const": "prc.provider-capabilities/v0.1"},
+    "capabilities": {
+      "type": "array",
+      "maxItems": 765,
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["collector_id", "control_id", "clause_ordinal", "authority"],
+        "properties": {
+          "collector_id": {"type": "string", "pattern": "^prc\\.collect\\.[a-z0-9.-]+@[0-9]+\\.[0-9]+$"},
+          "control_id": {"type": "string", "pattern": "^(PRC-[0-9]{2}-[0-9]{3}|USEQ-[A-F0-9]{8})$"},
+          "clause_ordinal": {"type": "integer", "minimum": 1, "maximum": 50},
+          "authority": {"enum": ["repository", "artifact", "executed", "environment", "external_registry", "structured_record"]}
+        }
+      }
+    }
+  }
+}

package/bin/schemas/run-result-v0.10.schema.json

@@ -10,11 +10,11 @@
     "run_id": {"type": "string", "pattern": "^[0-9a-f]{64}$"},
     "started_at": {"type": "string", "format": "date-time"},
     "completed_at": {"type": "string", "format": "date-time"},
-    "plan": {"$ref": "plan.schema.json"},
-    "inventory": {"$ref": "inventory.schema.json"},
-    "adapter_executions": {"type": "array", "items": {"$ref": "adapter-execution.schema.json"}},
+    "plan": {"$ref": "plan-v0.6.schema.json"},
+    "inventory": {"$ref": "inventory-v0.3.schema.json"},
+    "adapter_executions": {"type": "array", "items": {"$ref": "adapter-execution-v0.3.schema.json"}},
     "results": {"type": "array", "items": {"$ref": "#/$defs/assertion_result"}},
-    "findings": {"type": "array", "items": {"$ref": "finding.schema.json"}},
+    "findings": {"type": "array", "items": {"$ref": "finding-v0.1.schema.json"}},
     "terminal_state": {"$ref": "#/$defs/terminal_state"}
   },
   "$defs": {
@@ -33,7 +33,7 @@
         "summary": {"type": "string"},
         "locations": {"type": "array", "maxItems": 4096, "uniqueItems": true, "items": {"$ref": "#/$defs/location"}},
         "evidence_required": {"type": "array", "items": {"$ref": "#/$defs/evidence_requirement"}},
-        "evidence_observed": {"type": "array", "items": {"$ref": "evidence.schema.json"}},
+        "evidence_observed": {"type": "array", "items": {"$ref": "evidence-v0.1.schema.json"}},
         "remediation_class": {"enum": ["R0", "R1", "R2", "R3", "R4", "R5", "R6"]}
       }
     },

package/bin/schemas/run-result-v0.11.schema.json

@@ -10,14 +10,14 @@
     "run_id": {"type": "string", "pattern": "^[0-9a-f]{64}$"},
     "started_at": {"type": "string", "format": "date-time"},
     "completed_at": {"type": "string", "format": "date-time"},
-    "plan": {"$ref": "plan.schema.json"},
-    "inventory": {"$ref": "inventory.schema.json"},
-    "adapter_executions": {"type": "array", "items": {"$ref": "adapter-execution.schema.json"}},
+    "plan": {"$ref": "plan-v0.6.schema.json"},
+    "inventory": {"$ref": "inventory-v0.3.schema.json"},
+    "adapter_executions": {"type": "array", "items": {"$ref": "adapter-execution-v0.3.schema.json"}},
     "results": {
       "type": "array",
       "items": {"$ref": "#/$defs/assertion_result"}
     },
-    "findings": {"type": "array", "items": {"$ref": "finding.schema.json"}},
+    "findings": {"type": "array", "items": {"$ref": "finding-v0.1.schema.json"}},
     "control_catalog": {"$ref": "#/$defs/control_catalog"},
     "control_results": {
       "type": "array",
@@ -113,7 +113,7 @@
             "type": "array",
             "items": {"$ref": "#/$defs/evidence_requirement"}
           },
-          "evidence_observed": {"type": "array", "items": {"$ref": "evidence.schema.json"}},
+          "evidence_observed": {"type": "array", "items": {"$ref": "evidence-v0.1.schema.json"}},
           "remediation_class": {"enum": ["R0", "R1", "R2", "R3", "R4", "R5", "R6"]}
         }
     },

package/bin/schemas/run-result-v0.12.schema.json

@@ -0,0 +1,270 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://marinjursic.github.io/production-readiness-checklist/schemas/run-result-v0.12.schema.json",
+  "title": "Production Readiness Run Result v0.12",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schema_version", "run_id", "started_at", "completed_at", "plan", "inventory", "adapter_executions", "results", "findings", "terminal_state"],
+  "properties": {
+    "schema_version": {"const": "prc.run/v0.12"},
+    "run_id": {"type": "string", "pattern": "^[0-9a-f]{64}$"},
+    "started_at": {"type": "string", "format": "date-time"},
+    "completed_at": {"type": "string", "format": "date-time"},
+    "plan": {"$ref": "plan-v0.6.schema.json"},
+    "inventory": {"$ref": "inventory-v0.3.schema.json"},
+    "adapter_executions": {"type": "array", "items": {"$ref": "adapter-execution-v0.3.schema.json"}},
+    "results": {
+      "type": "array",
+      "items": {"$ref": "#/$defs/assertion_result"}
+    },
+    "findings": {"type": "array", "items": {"$ref": "finding-v0.1.schema.json"}},
+    "control_catalog": {"$ref": "#/$defs/control_catalog"},
+    "control_results": {
+      "type": "array",
+      "maxItems": 100000,
+      "items": {"$ref": "#/$defs/control_result"}
+    },
+    "deterministic_evidence": {
+      "type": "array",
+      "maxItems": 100000,
+      "items": {"$ref": "control-check-evidence-v0.1.schema.json"}
+    },
+    "terminal_state": {"$ref": "#/$defs/terminal_state"}
+  },
+  "$defs": {
+    "control_catalog": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["schema_version", "registry_version", "registry_sha256", "source_sha256", "contract_schema_version", "contract_generator_id", "contract_sha256", "classification_methodology_sha256", "classification_summary_sha256", "classification_corpus_sha256", "control_check_bindings_schema_version", "control_check_bindings_sha256", "control_check_programs_schema_version", "control_check_programs_sha256", "control_check_programs_catalog_sha256", "control_check_definition_schema_sha256", "control_check_definition_corpus_sha256", "control_count", "active_control_count", "contract_count", "generated_contract_count", "agent_reviewed_contract_count", "reviewed_deterministic_count", "reviewed_nondeterministic_count", "deterministic_binding_count", "deterministic_program_template_count", "deterministic_program_blocked_count", "profile_terminal_state"],
+      "properties": {
+        "schema_version": {"const": "prc.control-catalog-summary/v0.1"},
+        "registry_version": {"type": "string", "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$"},
+        "registry_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"},
+        "source_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"},
+        "contract_schema_version": {"const": "prc.control-contracts/v0.2"},
+        "contract_generator_id": {"const": "prc.control-contracts@0.2"},
+        "contract_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"},
+        "classification_methodology_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"},
+        "classification_summary_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"},
+        "classification_corpus_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"},
+        "control_check_bindings_schema_version": {"const": "prc.control-check-bindings/v0.1"},
+        "control_check_bindings_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"},
+        "control_check_programs_schema_version": {"const": "prc.control-check-program-catalog/v0.4"},
+        "control_check_programs_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"},
+        "control_check_programs_catalog_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"},
+        "control_check_definition_schema_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"},
+        "control_check_definition_corpus_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"},
+        "control_count": {"type": "integer", "minimum": 1, "maximum": 100000},
+        "active_control_count": {"type": "integer", "minimum": 0, "maximum": 100000},
+        "contract_count": {"type": "integer", "minimum": 1, "maximum": 100000},
+        "generated_contract_count": {"type": "integer", "minimum": 0, "maximum": 100000},
+        "agent_reviewed_contract_count": {"type": "integer", "minimum": 0, "maximum": 100000},
+        "reviewed_deterministic_count": {"type": "integer", "minimum": 1, "maximum": 100000},
+        "reviewed_nondeterministic_count": {"type": "integer", "minimum": 1, "maximum": 100000},
+        "deterministic_binding_count": {"type": "integer", "minimum": 1, "maximum": 100000},
+        "deterministic_program_template_count": {"type": "integer", "minimum": 1, "maximum": 100000},
+        "deterministic_program_blocked_count": {"type": "integer", "minimum": 0, "maximum": 100000},
+        "deterministic_program_executed_count": {"type": "integer", "minimum": 0, "maximum": 100000},
+        "deterministic_program_pass_count": {"type": "integer", "minimum": 0, "maximum": 100000},
+        "deterministic_program_fail_count": {"type": "integer", "minimum": 0, "maximum": 100000},
+        "deterministic_program_not_applicable_count": {"type": "integer", "minimum": 0, "maximum": 100000},
+        "profile_terminal_state": {"$ref": "#/$defs/terminal_state"},
+        "ai_review_provider": {"enum": ["codex", "claude"]},
+        "ai_review_model": {"type": "string"},
+        "ai_review_depth": {"enum": ["standard", "deep"]},
+        "ai_review_state": {"enum": ["complete", "focused", "partial"]},
+        "ai_reviewed_count": {"type": "integer", "minimum": 0, "maximum": 100000},
+        "ai_advisory_fail_count": {"type": "integer", "minimum": 0, "maximum": 100000}
+      }
+    },
+    "deterministic_clause_result": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["template_id", "collector_id", "clause_id", "clause_ordinal", "implementation_id", "implementation_contract_sha256", "required_authority", "status", "evaluated_at"],
+      "properties": {
+        "template_id": {"type": "string", "pattern": "^[0-9a-f]{64}$"},
+        "collector_id": {"type": "string", "pattern": "^prc\\.collect\\.[a-z0-9.-]+@[0-9]+\\.[0-9]+$"},
+        "clause_id": {"type": "string", "pattern": "^[0-9a-f]{64}$"},
+        "clause_ordinal": {"type": "integer", "minimum": 1, "maximum": 50},
+        "implementation_id": {"type": "string", "pattern": "^prc\\.check\\.[a-z0-9-]+@[0-9]+\\.[0-9]+$"},
+        "implementation_contract_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"},
+        "required_authority": {"enum": ["repository", "artifact", "executed", "environment", "external_registry", "structured_record"]},
+        "provider_id": {"type": "string", "minLength": 1, "maxLength": 4096},
+        "program_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"},
+        "evidence_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"},
+        "status": {"enum": ["passed", "failed", "not_applicable", "blocked_binding", "blocked_provider_unregistered", "blocked_provider_authority", "blocked_collection", "blocked_evidence", "blocked_canceled"]},
+        "outcome": {"enum": ["pass", "fail", "blocked", "not_applicable"]},
+        "reason_code": {"type": "string", "minLength": 1, "maxLength": 128},
+        "evaluated_at": {"type": "string", "format": "date-time"}
+      },
+      "allOf": [
+        {
+          "if": {"properties": {"status": {"enum": ["passed", "failed", "not_applicable", "blocked_evidence"]}}},
+          "then": {"required": ["provider_id", "program_sha256", "evidence_sha256", "outcome", "reason_code"]}
+        }
+      ]
+    },
+    "control_result": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["control_id", "revision", "statement", "source", "contract_sha256", "contract_status", "classification", "classification_route", "classification_decision_basis", "classification_row_sha256", "canonical_control_id", "evaluation_class", "automation_class", "applicability_class", "atomicity", "complete_inventory_required", "negative_condition", "project_thresholds_required", "evidence_authorities", "not_applicable_proof", "disposition", "coverage", "authority", "assertion_ids", "executed_assertion_ids", "summary"],
+      "properties": {
+        "control_id": {"type": "string", "pattern": "^(PRC-[0-9]{2}-[0-9]{3}|USEQ-[A-F0-9]{8})$"},
+        "revision": {"type": "integer", "minimum": 1},
+        "statement": {"type": "string", "minLength": 1, "maxLength": 16384},
+        "source": {"$ref": "#/$defs/control_source"},
+        "contract_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"},
+        "contract_status": {"const": "reviewed"},
+        "classification": {"enum": ["deterministic", "nondeterministic"]},
+        "classification_route": {"enum": ["local_static", "artifact_verification", "bounded_execution", "external_readonly_query", "structured_record_validation", "deterministic_composite", "contextual_judgment", "accountable_human_decision", "specialist_or_legal_judgment", "empirical_protocol_undefined", "contract_incomplete", "mixed", "unbounded_claim"]},
+        "classification_decision_basis": {"enum": ["primary_nondeterministic", "skeptically_rejected", "strength_audit_confirmed", "strength_audit_reclassified"]},
+        "classification_row_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"},
+        "deterministic_binding_id": {"type": "string", "pattern": "^(PRC-[0-9]{2}-[0-9]{3}|USEQ-[A-F0-9]{8})@[1-9][0-9]*$"},
+        "deterministic_binding_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"},
+        "deterministic_program_template_count": {"type": "integer", "minimum": 1, "maximum": 50},
+        "deterministic_program_status": {"enum": ["blocked_provider_unregistered", "blocked_program_incomplete", "blocked_evidence", "executed_pass", "executed_fail", "executed_not_applicable"]},
+        "deterministic_clause_results": {"type": "array", "minItems": 1, "maxItems": 50, "items": {"$ref": "#/$defs/deterministic_clause_result"}},
+        "canonical_control_id": {"type": "string", "pattern": "^(PRC-[0-9]{2}-[0-9]{3}|USEQ-[A-F0-9]{8})$"},
+        "evaluation_class": {"enum": ["repository", "environment", "human_external", "mixed", "unclassified"]},
+        "automation_class": {"enum": ["deterministic_candidate", "ai_advisory_candidate", "environment_evidence_required", "human_or_external_required", "mixed_evidence_required"]},
+        "applicability_class": {"enum": ["conditional", "scope_required"]},
+        "atomicity": {"enum": ["apparently_atomic", "compound_review_required"]},
+        "complete_inventory_required": {"type": "boolean"},
+        "negative_condition": {"type": "boolean"},
+        "project_thresholds_required": {"type": "boolean"},
+        "evidence_authorities": {"type": "array", "minItems": 1, "uniqueItems": true, "items": {"enum": ["declared", "repository", "artifact", "executed", "environment", "external_registry", "structured_record", "human"]}},
+        "not_applicable_proof": {"type": "string", "minLength": 1, "maxLength": 1000},
+        "disposition": {"enum": ["confirmed_failure", "verified_pass", "not_applicable", "blocked", "partially_verified", "needs_review", "retired"]},
+        "coverage": {"enum": ["deterministic_program_provider_unregistered", "deterministic_program_partial", "deterministic_program_complete", "nondeterministic_advisory"]},
+        "authority": {"enum": ["none", "deterministic_partial", "deterministic_exact"]},
+        "assertion_ids": {"type": "array", "uniqueItems": true, "items": {"type": "string"}},
+        "executed_assertion_ids": {"type": "array", "uniqueItems": true, "items": {"type": "string"}},
+        "summary": {"type": "string", "minLength": 1},
+        "ai_review": {"$ref": "#/$defs/ai_control_review"}
+      },
+      "allOf": [
+        {
+          "if": {"properties": {"classification": {"const": "deterministic"}}},
+          "then": {
+            "required": ["deterministic_binding_id", "deterministic_binding_sha256", "deterministic_program_template_count", "deterministic_program_status"],
+            "properties": {
+              "classification_route": {"enum": ["local_static", "artifact_verification", "bounded_execution", "external_readonly_query", "structured_record_validation", "deterministic_composite"]},
+              "classification_decision_basis": {"const": "strength_audit_confirmed"},
+              "disposition": {"enum": ["confirmed_failure", "verified_pass", "not_applicable", "blocked"]},
+              "coverage": {"enum": ["deterministic_program_provider_unregistered", "deterministic_program_partial", "deterministic_program_complete"]}
+            }
+          },
+          "else": {
+            "not": {"anyOf": [{"required": ["deterministic_binding_id"]}, {"required": ["deterministic_binding_sha256"]}, {"required": ["deterministic_program_template_count"]}, {"required": ["deterministic_program_status"]}, {"required": ["deterministic_clause_results"]}]},
+            "properties": {
+              "classification_route": {"enum": ["contextual_judgment", "accountable_human_decision", "specialist_or_legal_judgment", "empirical_protocol_undefined", "contract_incomplete", "mixed", "unbounded_claim"]},
+              "classification_decision_basis": {"enum": ["primary_nondeterministic", "skeptically_rejected", "strength_audit_reclassified"]},
+              "disposition": {"const": "needs_review"},
+              "coverage": {"const": "nondeterministic_advisory"},
+              "authority": {"const": "none"}
+            }
+          }
+        },
+        {
+          "if": {"properties": {"deterministic_program_status": {"const": "executed_pass"}}, "required": ["deterministic_program_status"]},
+          "then": {"required": ["deterministic_clause_results"], "properties": {"disposition": {"const": "verified_pass"}, "coverage": {"const": "deterministic_program_complete"}, "authority": {"const": "deterministic_exact"}}}
+        },
+        {
+          "if": {"properties": {"deterministic_program_status": {"const": "executed_fail"}}, "required": ["deterministic_program_status"]},
+          "then": {"required": ["deterministic_clause_results"], "properties": {"disposition": {"const": "confirmed_failure"}, "authority": {"const": "deterministic_exact"}}}
+        },
+        {
+          "if": {"properties": {"deterministic_program_status": {"const": "executed_not_applicable"}}, "required": ["deterministic_program_status"]},
+          "then": {"required": ["deterministic_clause_results"], "properties": {"disposition": {"const": "not_applicable"}, "coverage": {"const": "deterministic_program_complete"}, "authority": {"const": "deterministic_exact"}}}
+        }
+      ]
+    },
+    "control_source": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["path", "line"],
+      "properties": {
+        "path": {"type": "string", "pattern": "^docs/(checklists|engineering)/.+\\.md$"},
+        "line": {"type": "integer", "minimum": 1}
+      }
+    },
+    "ai_control_review": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["provider", "review_depth", "assessment_candidate", "applicability_candidate", "confidence", "priority", "reason", "challenge", "risk_if_ignored", "advice", "remediation_steps", "verification_steps", "evidence_needed", "evidence", "limitations", "task_id"],
+      "properties": {
+        "provider": {"enum": ["codex", "claude"]},
+        "model": {"type": "string"},
+        "review_depth": {"enum": ["standard", "deep"]},
+        "assessment_candidate": {"enum": ["advisory_pass_candidate", "advisory_fail_candidate", "needs_evidence", "not_applicable_candidate"]},
+        "applicability_candidate": {"enum": ["applicable", "not_applicable", "undetermined"]},
+        "confidence": {"enum": ["low", "medium", "high"]},
+        "priority": {"enum": ["critical", "high", "medium", "low", "none"]},
+        "reason": {"type": "string", "minLength": 1, "maxLength": 16384},
+        "challenge": {"type": "string", "minLength": 1, "maxLength": 16384},
+        "risk_if_ignored": {"type": "string", "minLength": 1, "maxLength": 16384},
+        "advice": {"type": "string", "minLength": 1, "maxLength": 16384},
+        "remediation_steps": {"type": "array", "minItems": 1, "maxItems": 12, "uniqueItems": true, "items": {"type": "string", "minLength": 1, "maxLength": 16384}},
+        "verification_steps": {"type": "array", "minItems": 1, "maxItems": 12, "uniqueItems": true, "items": {"type": "string", "minLength": 1, "maxLength": 16384}},
+        "evidence_needed": {"type": "array", "minItems": 1, "maxItems": 12, "uniqueItems": true, "items": {"type": "string", "minLength": 1, "maxLength": 16384}},
+        "evidence": {"type": "array", "maxItems": 256, "items": {"$ref": "#/$defs/location"}},
+        "limitations": {"type": "array", "minItems": 1, "maxItems": 256, "uniqueItems": true, "items": {"type": "string", "minLength": 1, "maxLength": 16384}},
+        "citation_verification": {"enum": ["not_cited", "snapshot_location_validated"]},
+        "claim_verification": {"const": "advisory_unverified"},
+        "task_id": {"type": "string", "pattern": "^[0-9a-f]{64}$"}
+      }
+    },
+    "assertion_result": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["assertion_id", "control_ids", "applicability", "execution", "assessment", "severity", "gate", "summary", "evidence_required", "evidence_observed", "remediation_class"],
+        "properties": {
+          "assertion_id": {"type": "string"},
+          "control_ids": {"type": "array", "items": {"type": "string"}},
+          "applicability": {"enum": ["applicable", "not_applicable", "undetermined"]},
+          "execution": {"enum": ["not_run", "completed", "blocked", "error"]},
+          "assessment": {"enum": ["pass", "fail", "unknown", "manual_review", "not_applicable", "stale", "conflicting"]},
+          "severity": {"enum": ["info", "low", "medium", "high", "critical"]},
+          "gate": {"enum": ["advisory", "required", "no-go"]},
+          "summary": {"type": "string"},
+          "locations": {
+            "type": "array",
+            "maxItems": 4096,
+            "uniqueItems": true,
+            "items": {"$ref": "#/$defs/location"}
+          },
+          "evidence_required": {
+            "type": "array",
+            "items": {"$ref": "#/$defs/evidence_requirement"}
+          },
+          "evidence_observed": {"type": "array", "items": {"$ref": "evidence-v0.1.schema.json"}},
+          "remediation_class": {"enum": ["R0", "R1", "R2", "R3", "R4", "R5", "R6"]}
+        }
+    },
+    "terminal_state": {
+      "enum": ["profile_satisfied", "machine_work_complete_manual_evidence_remaining", "assessment_incomplete", "no_go", "policy_stopped", "budget_exhausted", "environment_blocked"]
+    },
+    "location": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["path"],
+      "properties": {
+        "path": {"type": "string", "minLength": 1},
+        "line": {"type": "integer", "minimum": 0},
+        "column": {"type": "integer", "minimum": 0}
+      }
+    },
+    "evidence_requirement": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["kind", "minimum_authority", "description"],
+      "properties": {
+        "kind": {"type": "string", "pattern": "^[a-z0-9-]+$"},
+        "minimum_authority": {
+          "enum": ["declared", "repository", "executed", "artifact", "environment", "human"]
+        },
+        "description": {"type": "string", "minLength": 1}
+      }
+    }
+  }
+}