@marinjursic/prc-linux-arm64 0.1.0 → 0.2.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (98) hide show
  1. package/DISCLOSURE +21 -0
  2. package/README.md +5 -1
  3. package/bin/catalog/assertions/core-repository.yaml +28 -28
  4. package/bin/catalog/control-check-bindings.json.gz +0 -0
  5. package/bin/catalog/control-check-programs.json.gz +0 -0
  6. package/bin/catalog/control-contracts.json.gz +0 -0
  7. package/bin/catalog/control-id-registry.json.gz +0 -0
  8. package/bin/fixtures/benchmarks/core-native/suite-comprehensive.yaml +10 -1
  9. package/bin/fixtures/benchmarks/core-native/suite.yaml +13 -2
  10. package/bin/packs/core-foundation.yaml +4 -4
  11. package/bin/packs/core-native.yaml +10 -10
  12. package/bin/prc +0 -0
  13. package/bin/schemas/adapter-execution-v0.3.schema.json +145 -0
  14. package/bin/schemas/authoritative-evidence-bundle.schema.json +38 -0
  15. package/bin/schemas/authoritative-evidence-set.schema.json +38 -0
  16. package/bin/schemas/authoritative-evidence-verification.schema.json +54 -0
  17. package/bin/schemas/automatic-coverage.schema.json +49 -0
  18. package/bin/schemas/control-check-bindings.schema.json +119 -0
  19. package/bin/schemas/control-check-evidence-v0.1.schema.json +244 -0
  20. package/bin/schemas/control-check-evidence.schema.json +244 -0
  21. package/bin/schemas/control-check-program-catalog.schema.json +160 -0
  22. package/bin/schemas/control-check-program-definitions.schema.json +139 -0
  23. package/bin/schemas/control-check-program.schema.json +298 -0
  24. package/bin/schemas/control-classification-final.schema.json +64 -0
  25. package/bin/schemas/control-classification-review.schema.json +161 -0
  26. package/bin/schemas/control-classification-skeptic-review.schema.json +96 -0
  27. package/bin/schemas/control-classification-strength-review.schema.json +90 -0
  28. package/bin/schemas/control-contracts.schema.json +101 -12
  29. package/bin/schemas/control-review-output-v0.2.schema.json +66 -0
  30. package/bin/schemas/control-review-output.schema.json +22 -3
  31. package/bin/schemas/evidence-requirements.schema.json +144 -0
  32. package/bin/schemas/evidence-set-verification.schema.json +65 -0
  33. package/bin/schemas/provider-capabilities.schema.json +26 -0
  34. package/bin/schemas/run-result-v0.10.schema.json +5 -5
  35. package/bin/schemas/run-result-v0.11.schema.json +5 -5
  36. package/bin/schemas/run-result-v0.12.schema.json +270 -0
  37. package/bin/schemas/run-result.schema.json +166 -16
  38. package/bin/schemas/signature-verification.schema.json +8 -1
  39. package/bin/schemas/signature.schema.json +8 -1
  40. package/bin/schemas/trust-store.schema.json +8 -1
  41. package/manifest.json +1144 -5
  42. package/package.json +8 -3
  43. package/bin/LICENSE +0 -21
  44. package/bin/README.md +0 -335
  45. package/bin/catalog/control-contracts.json +0 -1
  46. package/bin/catalog/control-id-registry.json +0 -110470
  47. package/bin/docs/architecture/adapters.md +0 -380
  48. package/bin/docs/architecture/agent-providers.md +0 -188
  49. package/bin/docs/architecture/applicability.md +0 -80
  50. package/bin/docs/architecture/catalog-integrity.md +0 -85
  51. package/bin/docs/architecture/evidence-and-results.md +0 -154
  52. package/bin/docs/architecture/execution-plans.md +0 -61
  53. package/bin/docs/architecture/product-contract.md +0 -76
  54. package/bin/docs/architecture/publisher-trust.md +0 -68
  55. package/bin/docs/architecture/remediation-contract.md +0 -113
  56. package/bin/docs/architecture/trust-model.md +0 -95
  57. package/bin/docs/assets/hero.svg +0 -37
  58. package/bin/docs/assets/logo.svg +0 -13
  59. package/bin/docs/assets/production-readiness-scan-demo-poster.png +0 -0
  60. package/bin/docs/assets/production-readiness-scan-demo.gif +0 -0
  61. package/bin/docs/assets/production-readiness-scan-demo.mp4 +0 -0
  62. package/bin/docs/assets/social-card.png +0 -0
  63. package/bin/docs/assets/social-card.svg +0 -40
  64. package/bin/docs/engineering/source-manifest.md +0 -479
  65. package/bin/docs/guides/ai-assisted-review.md +0 -61
  66. package/bin/docs/guides/getting-started.md +0 -78
  67. package/bin/docs/index.md +0 -66
  68. package/bin/docs/prompts/evidence-challenge.md +0 -26
  69. package/bin/docs/prompts/full-readiness-review.md +0 -34
  70. package/bin/docs/prompts/release-diff-review.md +0 -31
  71. package/bin/docs/records/evidence-record.md +0 -42
  72. package/bin/docs/records/go-no-go-decision.md +0 -63
  73. package/bin/docs/records/release-assessment.md +0 -124
  74. package/bin/docs/records/risk-exception.md +0 -64
  75. package/bin/docs/references.md +0 -52
  76. package/bin/docs/scanner/ai-control-review.md +0 -208
  77. package/bin/docs/scanner/benchmarks.md +0 -122
  78. package/bin/docs/scanner/cli-contract.md +0 -130
  79. package/bin/docs/scanner/configuration.md +0 -101
  80. package/bin/docs/scanner/control-contracts.md +0 -47
  81. package/bin/docs/scanner/core-repository.md +0 -62
  82. package/bin/docs/scanner/diff-and-invalidation.md +0 -79
  83. package/bin/docs/scanner/doctor.md +0 -71
  84. package/bin/docs/scanner/getting-started.md +0 -355
  85. package/bin/docs/scanner/go-http-timeouts.md +0 -96
  86. package/bin/docs/scanner/infrastructure-policy.md +0 -64
  87. package/bin/docs/scanner/kubernetes-workloads.md +0 -63
  88. package/bin/docs/scanner/mcp-agent-integration.md +0 -138
  89. package/bin/docs/scanner/openapi-contracts.md +0 -75
  90. package/bin/docs/scanner/private-key-armor.md +0 -44
  91. package/bin/docs/scanner/releases.md +0 -160
  92. package/bin/docs/scanner/remediation.md +0 -273
  93. package/bin/docs/scanner/risk-exceptions.md +0 -52
  94. package/bin/docs/scanner/security-walkthrough.md +0 -236
  95. package/bin/docs/scanner/state-and-history.md +0 -113
  96. package/bin/docs/scanner/supply-chain.md +0 -132
  97. package/bin/docs/scanner/test-discovery.md +0 -60
  98. package/bin/docs/stylesheets/extra.css +0 -183
@@ -1,12 +1,12 @@
1
1
  {
2
2
  "$schema": "https://json-schema.org/draft/2020-12/schema",
3
3
  "$id": "https://marinjursic.github.io/production-readiness-checklist/schemas/run-result.schema.json",
4
- "title": "Production Readiness Run Result v0.12",
4
+ "title": "Production Readiness Run Result v0.13",
5
5
  "type": "object",
6
6
  "additionalProperties": false,
7
- "required": ["schema_version", "run_id", "started_at", "completed_at", "plan", "inventory", "adapter_executions", "results", "findings", "terminal_state"],
7
+ "required": ["schema_version", "run_id", "started_at", "completed_at", "plan", "inventory", "adapter_executions", "results", "findings", "authoritative_evidence_bundles", "terminal_state"],
8
8
  "properties": {
9
- "schema_version": {"const": "prc.run/v0.12"},
9
+ "schema_version": {"const": "prc.run/v0.13"},
10
10
  "run_id": {"type": "string", "pattern": "^[0-9a-f]{64}$"},
11
11
  "started_at": {"type": "string", "format": "date-time"},
12
12
  "completed_at": {"type": "string", "format": "date-time"},
@@ -24,44 +24,112 @@
24
24
  "maxItems": 100000,
25
25
  "items": {"$ref": "#/$defs/control_result"}
26
26
  },
27
+ "deterministic_evidence": {
28
+ "type": "array",
29
+ "maxItems": 100000,
30
+ "items": {"$ref": "control-check-evidence.schema.json"}
31
+ },
32
+ "authoritative_evidence_bundles": {
33
+ "type": "array",
34
+ "maxItems": 16,
35
+ "items": {"$ref": "authoritative-evidence-verification.schema.json"}
36
+ },
37
+ "ai_improvement_plan": {"$ref": "#/$defs/ai_improvement_plan"},
27
38
  "terminal_state": {"$ref": "#/$defs/terminal_state"}
28
39
  },
29
40
  "$defs": {
30
41
  "control_catalog": {
31
42
  "type": "object",
32
43
  "additionalProperties": false,
33
- "required": ["schema_version", "registry_version", "registry_sha256", "source_sha256", "contract_schema_version", "contract_sha256", "control_count", "active_control_count", "contract_count", "generated_contract_count", "expert_reviewed_contract_count", "profile_terminal_state"],
44
+ "required": ["schema_version", "registry_version", "registry_sha256", "source_sha256", "contract_schema_version", "contract_generator_id", "contract_sha256", "classification_methodology_sha256", "classification_summary_sha256", "classification_corpus_sha256", "control_check_bindings_schema_version", "control_check_bindings_sha256", "control_check_programs_schema_version", "control_check_programs_sha256", "control_check_programs_catalog_sha256", "control_check_definition_schema_sha256", "control_check_definition_corpus_sha256", "control_count", "active_control_count", "contract_count", "generated_contract_count", "agent_reviewed_contract_count", "reviewed_deterministic_count", "reviewed_nondeterministic_count", "deterministic_binding_count", "deterministic_program_template_count", "deterministic_program_blocked_count", "profile_terminal_state"],
34
45
  "properties": {
35
46
  "schema_version": {"const": "prc.control-catalog-summary/v0.1"},
36
47
  "registry_version": {"type": "string", "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$"},
37
48
  "registry_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"},
38
49
  "source_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"},
39
- "contract_schema_version": {"const": "prc.control-contracts/v0.1"},
50
+ "contract_schema_version": {"const": "prc.control-contracts/v0.2"},
51
+ "contract_generator_id": {"const": "prc.control-contracts@0.2"},
40
52
  "contract_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"},
53
+ "classification_methodology_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"},
54
+ "classification_summary_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"},
55
+ "classification_corpus_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"},
56
+ "control_check_bindings_schema_version": {"const": "prc.control-check-bindings/v0.1"},
57
+ "control_check_bindings_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"},
58
+ "control_check_programs_schema_version": {"const": "prc.control-check-program-catalog/v0.4"},
59
+ "control_check_programs_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"},
60
+ "control_check_programs_catalog_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"},
61
+ "control_check_definition_schema_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"},
62
+ "control_check_definition_corpus_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"},
41
63
  "control_count": {"type": "integer", "minimum": 1, "maximum": 100000},
42
64
  "active_control_count": {"type": "integer", "minimum": 0, "maximum": 100000},
43
65
  "contract_count": {"type": "integer", "minimum": 1, "maximum": 100000},
44
66
  "generated_contract_count": {"type": "integer", "minimum": 0, "maximum": 100000},
45
- "expert_reviewed_contract_count": {"type": "integer", "minimum": 0, "maximum": 100000},
67
+ "agent_reviewed_contract_count": {"type": "integer", "minimum": 0, "maximum": 100000},
68
+ "reviewed_deterministic_count": {"type": "integer", "minimum": 1, "maximum": 100000},
69
+ "reviewed_nondeterministic_count": {"type": "integer", "minimum": 1, "maximum": 100000},
70
+ "deterministic_binding_count": {"type": "integer", "minimum": 1, "maximum": 100000},
71
+ "deterministic_program_template_count": {"type": "integer", "minimum": 1, "maximum": 100000},
72
+ "deterministic_program_blocked_count": {"type": "integer", "minimum": 0, "maximum": 100000},
73
+ "deterministic_program_executed_count": {"type": "integer", "minimum": 0, "maximum": 100000},
74
+ "deterministic_program_pass_count": {"type": "integer", "minimum": 0, "maximum": 100000},
75
+ "deterministic_program_fail_count": {"type": "integer", "minimum": 0, "maximum": 100000},
76
+ "deterministic_program_not_applicable_count": {"type": "integer", "minimum": 0, "maximum": 100000},
46
77
  "profile_terminal_state": {"$ref": "#/$defs/terminal_state"},
47
78
  "ai_review_provider": {"enum": ["codex", "claude"]},
48
79
  "ai_review_model": {"type": "string"},
49
- "ai_review_state": {"enum": ["complete", "focused"]},
80
+ "ai_review_depth": {"enum": ["standard", "deep"]},
81
+ "ai_review_state": {"enum": ["complete", "focused", "partial"]},
50
82
  "ai_reviewed_count": {"type": "integer", "minimum": 0, "maximum": 100000},
51
83
  "ai_advisory_fail_count": {"type": "integer", "minimum": 0, "maximum": 100000}
52
84
  }
53
85
  },
86
+ "deterministic_clause_result": {
87
+ "type": "object",
88
+ "additionalProperties": false,
89
+ "required": ["template_id", "collector_id", "clause_id", "clause_ordinal", "implementation_id", "implementation_contract_sha256", "required_authority", "status", "evaluated_at"],
90
+ "properties": {
91
+ "template_id": {"type": "string", "pattern": "^[0-9a-f]{64}$"},
92
+ "collector_id": {"type": "string", "pattern": "^prc\\.collect\\.[a-z0-9.-]+@[0-9]+\\.[0-9]+$"},
93
+ "clause_id": {"type": "string", "pattern": "^[0-9a-f]{64}$"},
94
+ "clause_ordinal": {"type": "integer", "minimum": 1, "maximum": 50},
95
+ "implementation_id": {"type": "string", "pattern": "^prc\\.check\\.[a-z0-9-]+@[0-9]+\\.[0-9]+$"},
96
+ "implementation_contract_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"},
97
+ "required_authority": {"enum": ["repository", "artifact", "executed", "environment", "external_registry", "structured_record"]},
98
+ "provider_id": {"type": "string", "minLength": 1, "maxLength": 4096},
99
+ "program_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"},
100
+ "evidence_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"},
101
+ "status": {"enum": ["passed", "failed", "not_applicable", "blocked_binding", "blocked_provider_unregistered", "blocked_provider_authority", "blocked_collection", "blocked_evidence", "blocked_canceled"]},
102
+ "outcome": {"enum": ["pass", "fail", "blocked", "not_applicable"]},
103
+ "reason_code": {"type": "string", "minLength": 1, "maxLength": 128},
104
+ "evaluated_at": {"type": "string", "format": "date-time"}
105
+ },
106
+ "allOf": [
107
+ {
108
+ "if": {"properties": {"status": {"enum": ["passed", "failed", "not_applicable", "blocked_evidence"]}}},
109
+ "then": {"required": ["provider_id", "program_sha256", "evidence_sha256", "outcome", "reason_code"]}
110
+ }
111
+ ]
112
+ },
54
113
  "control_result": {
55
114
  "type": "object",
56
115
  "additionalProperties": false,
57
- "required": ["control_id", "revision", "statement", "source", "contract_sha256", "contract_status", "canonical_control_id", "evaluation_class", "automation_class", "applicability_class", "atomicity", "complete_inventory_required", "negative_condition", "project_thresholds_required", "evidence_authorities", "not_applicable_proof", "disposition", "coverage", "authority", "assertion_ids", "executed_assertion_ids", "summary"],
116
+ "required": ["control_id", "revision", "statement", "source", "contract_sha256", "contract_status", "classification", "classification_route", "classification_decision_basis", "classification_row_sha256", "canonical_control_id", "evaluation_class", "automation_class", "applicability_class", "atomicity", "complete_inventory_required", "negative_condition", "project_thresholds_required", "evidence_authorities", "not_applicable_proof", "disposition", "coverage", "authority", "assertion_ids", "executed_assertion_ids", "summary"],
58
117
  "properties": {
59
118
  "control_id": {"type": "string", "pattern": "^(PRC-[0-9]{2}-[0-9]{3}|USEQ-[A-F0-9]{8})$"},
60
119
  "revision": {"type": "integer", "minimum": 1},
61
120
  "statement": {"type": "string", "minLength": 1, "maxLength": 16384},
62
121
  "source": {"$ref": "#/$defs/control_source"},
63
122
  "contract_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"},
64
- "contract_status": {"enum": ["generated_unreviewed", "reviewed", "retired"]},
123
+ "contract_status": {"const": "reviewed"},
124
+ "classification": {"enum": ["deterministic", "nondeterministic"]},
125
+ "classification_route": {"enum": ["local_static", "artifact_verification", "bounded_execution", "external_readonly_query", "structured_record_validation", "deterministic_composite", "contextual_judgment", "accountable_human_decision", "specialist_or_legal_judgment", "empirical_protocol_undefined", "contract_incomplete", "mixed", "unbounded_claim"]},
126
+ "classification_decision_basis": {"enum": ["primary_nondeterministic", "skeptically_rejected", "strength_audit_confirmed", "strength_audit_reclassified"]},
127
+ "classification_row_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"},
128
+ "deterministic_binding_id": {"type": "string", "pattern": "^(PRC-[0-9]{2}-[0-9]{3}|USEQ-[A-F0-9]{8})@[1-9][0-9]*$"},
129
+ "deterministic_binding_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"},
130
+ "deterministic_program_template_count": {"type": "integer", "minimum": 1, "maximum": 50},
131
+ "deterministic_program_status": {"enum": ["blocked_provider_unregistered", "blocked_program_incomplete", "blocked_evidence", "executed_pass", "executed_fail", "executed_not_applicable"]},
132
+ "deterministic_clause_results": {"type": "array", "minItems": 1, "maxItems": 50, "items": {"$ref": "#/$defs/deterministic_clause_result"}},
65
133
  "canonical_control_id": {"type": "string", "pattern": "^(PRC-[0-9]{2}-[0-9]{3}|USEQ-[A-F0-9]{8})$"},
66
134
  "evaluation_class": {"enum": ["repository", "environment", "human_external", "mixed", "unclassified"]},
67
135
  "automation_class": {"enum": ["deterministic_candidate", "ai_advisory_candidate", "environment_evidence_required", "human_or_external_required", "mixed_evidence_required"]},
@@ -70,16 +138,52 @@
70
138
  "complete_inventory_required": {"type": "boolean"},
71
139
  "negative_condition": {"type": "boolean"},
72
140
  "project_thresholds_required": {"type": "boolean"},
73
- "evidence_authorities": {"type": "array", "minItems": 1, "uniqueItems": true, "items": {"enum": ["declared", "repository", "artifact", "environment", "human"]}},
141
+ "evidence_authorities": {"type": "array", "minItems": 1, "uniqueItems": true, "items": {"enum": ["declared", "repository", "artifact", "executed", "environment", "external_registry", "structured_record", "human"]}},
74
142
  "not_applicable_proof": {"type": "string", "minLength": 1, "maxLength": 1000},
75
- "disposition": {"enum": ["confirmed_failure", "blocked", "partially_verified", "needs_review", "retired"]},
76
- "coverage": {"enum": ["unmapped", "not_in_selected_profile", "partial_assertions", "retired"]},
77
- "authority": {"enum": ["none", "deterministic_partial"]},
143
+ "disposition": {"enum": ["confirmed_failure", "verified_pass", "not_applicable", "blocked", "partially_verified", "needs_review", "retired"]},
144
+ "coverage": {"enum": ["deterministic_program_provider_unregistered", "deterministic_program_partial", "deterministic_program_complete", "nondeterministic_advisory"]},
145
+ "authority": {"enum": ["none", "deterministic_partial", "deterministic_exact"]},
78
146
  "assertion_ids": {"type": "array", "uniqueItems": true, "items": {"type": "string"}},
79
147
  "executed_assertion_ids": {"type": "array", "uniqueItems": true, "items": {"type": "string"}},
80
148
  "summary": {"type": "string", "minLength": 1},
81
149
  "ai_review": {"$ref": "#/$defs/ai_control_review"}
82
- }
150
+ },
151
+ "allOf": [
152
+ {
153
+ "if": {"properties": {"classification": {"const": "deterministic"}}},
154
+ "then": {
155
+ "required": ["deterministic_binding_id", "deterministic_binding_sha256", "deterministic_program_template_count", "deterministic_program_status"],
156
+ "properties": {
157
+ "classification_route": {"enum": ["local_static", "artifact_verification", "bounded_execution", "external_readonly_query", "structured_record_validation", "deterministic_composite"]},
158
+ "classification_decision_basis": {"const": "strength_audit_confirmed"},
159
+ "disposition": {"enum": ["confirmed_failure", "verified_pass", "not_applicable", "blocked"]},
160
+ "coverage": {"enum": ["deterministic_program_provider_unregistered", "deterministic_program_partial", "deterministic_program_complete"]}
161
+ }
162
+ },
163
+ "else": {
164
+ "not": {"anyOf": [{"required": ["deterministic_binding_id"]}, {"required": ["deterministic_binding_sha256"]}, {"required": ["deterministic_program_template_count"]}, {"required": ["deterministic_program_status"]}, {"required": ["deterministic_clause_results"]}]},
165
+ "properties": {
166
+ "classification_route": {"enum": ["contextual_judgment", "accountable_human_decision", "specialist_or_legal_judgment", "empirical_protocol_undefined", "contract_incomplete", "mixed", "unbounded_claim"]},
167
+ "classification_decision_basis": {"enum": ["primary_nondeterministic", "skeptically_rejected", "strength_audit_reclassified"]},
168
+ "disposition": {"const": "needs_review"},
169
+ "coverage": {"const": "nondeterministic_advisory"},
170
+ "authority": {"const": "none"}
171
+ }
172
+ }
173
+ },
174
+ {
175
+ "if": {"properties": {"deterministic_program_status": {"const": "executed_pass"}}, "required": ["deterministic_program_status"]},
176
+ "then": {"required": ["deterministic_clause_results"], "properties": {"disposition": {"const": "verified_pass"}, "coverage": {"const": "deterministic_program_complete"}, "authority": {"const": "deterministic_exact"}}}
177
+ },
178
+ {
179
+ "if": {"properties": {"deterministic_program_status": {"const": "executed_fail"}}, "required": ["deterministic_program_status"]},
180
+ "then": {"required": ["deterministic_clause_results"], "properties": {"disposition": {"const": "confirmed_failure"}, "authority": {"const": "deterministic_exact"}}}
181
+ },
182
+ {
183
+ "if": {"properties": {"deterministic_program_status": {"const": "executed_not_applicable"}}, "required": ["deterministic_program_status"]},
184
+ "then": {"required": ["deterministic_clause_results"], "properties": {"disposition": {"const": "not_applicable"}, "coverage": {"const": "deterministic_program_complete"}, "authority": {"const": "deterministic_exact"}}}
185
+ }
186
+ ]
83
187
  },
84
188
  "control_source": {
85
189
  "type": "object",
@@ -93,15 +197,26 @@
93
197
  "ai_control_review": {
94
198
  "type": "object",
95
199
  "additionalProperties": false,
96
- "required": ["provider", "assessment_candidate", "applicability_candidate", "confidence", "reason", "advice", "evidence", "limitations", "task_id"],
200
+ "required": ["provider", "review_depth", "assessment_candidate", "applicability_candidate", "confidence", "priority", "root_cause", "root_cause_key", "effort", "blast_radius", "reason", "challenge", "risk_if_ignored", "advice", "remediation_steps", "verification_steps", "evidence_needed", "evidence", "limitations", "task_id"],
97
201
  "properties": {
98
202
  "provider": {"enum": ["codex", "claude"]},
99
203
  "model": {"type": "string"},
204
+ "review_depth": {"enum": ["standard", "deep"]},
100
205
  "assessment_candidate": {"enum": ["advisory_pass_candidate", "advisory_fail_candidate", "needs_evidence", "not_applicable_candidate"]},
101
206
  "applicability_candidate": {"enum": ["applicable", "not_applicable", "undetermined"]},
102
207
  "confidence": {"enum": ["low", "medium", "high"]},
208
+ "priority": {"enum": ["critical", "high", "medium", "low", "none"]},
209
+ "root_cause": {"type": "string", "minLength": 1, "maxLength": 4096},
210
+ "root_cause_key": {"type": "string", "pattern": "^[a-z0-9][a-z0-9-]{2,79}$"},
211
+ "effort": {"enum": ["small", "medium", "large", "unknown"]},
212
+ "blast_radius": {"enum": ["local", "component", "system", "organization", "unknown"]},
103
213
  "reason": {"type": "string", "minLength": 1, "maxLength": 16384},
104
- "advice": {"type": "string", "maxLength": 16384},
214
+ "challenge": {"type": "string", "minLength": 1, "maxLength": 16384},
215
+ "risk_if_ignored": {"type": "string", "minLength": 1, "maxLength": 16384},
216
+ "advice": {"type": "string", "minLength": 1, "maxLength": 16384},
217
+ "remediation_steps": {"type": "array", "minItems": 1, "maxItems": 12, "uniqueItems": true, "items": {"type": "string", "minLength": 1, "maxLength": 16384}},
218
+ "verification_steps": {"type": "array", "minItems": 1, "maxItems": 12, "uniqueItems": true, "items": {"type": "string", "minLength": 1, "maxLength": 16384}},
219
+ "evidence_needed": {"type": "array", "minItems": 1, "maxItems": 12, "uniqueItems": true, "items": {"type": "string", "minLength": 1, "maxLength": 16384}},
105
220
  "evidence": {"type": "array", "maxItems": 256, "items": {"$ref": "#/$defs/location"}},
106
221
  "limitations": {"type": "array", "minItems": 1, "maxItems": 256, "uniqueItems": true, "items": {"type": "string", "minLength": 1, "maxLength": 16384}},
107
222
  "citation_verification": {"enum": ["not_cited", "snapshot_location_validated"]},
@@ -109,6 +224,41 @@
109
224
  "task_id": {"type": "string", "pattern": "^[0-9a-f]{64}$"}
110
225
  }
111
226
  },
227
+ "ai_improvement_plan": {
228
+ "type": "object",
229
+ "additionalProperties": false,
230
+ "required": ["schema_version", "authority", "source_run_id", "review_provider", "review_depth", "review_state", "reviewed_control_count", "item_count", "items"],
231
+ "properties": {
232
+ "schema_version": {"const": "prc.ai-improvement-plan/v0.1"},
233
+ "authority": {"const": "advisory_only"},
234
+ "source_run_id": {"type": "string", "pattern": "^[0-9a-f]{64}$"},
235
+ "review_provider": {"enum": ["codex", "claude"]},
236
+ "review_model": {"type": "string"},
237
+ "review_depth": {"enum": ["standard", "deep"]},
238
+ "review_state": {"enum": ["complete", "focused", "partial"]},
239
+ "reviewed_control_count": {"type": "integer", "minimum": 0, "maximum": 100000},
240
+ "item_count": {"type": "integer", "minimum": 0, "maximum": 100000},
241
+ "items": {"type": "array", "maxItems": 100000, "items": {"$ref": "#/$defs/ai_improvement_plan_item"}}
242
+ }
243
+ },
244
+ "ai_improvement_plan_item": {
245
+ "type": "object",
246
+ "additionalProperties": false,
247
+ "required": ["item_id", "domain", "root_cause_key", "root_cause", "priority", "effort", "blast_radius", "assessment_candidates", "control_count", "control_ids", "task_ids"],
248
+ "properties": {
249
+ "item_id": {"type": "string", "pattern": "^[0-9a-f]{64}$"},
250
+ "domain": {"type": "string", "pattern": "^(catalog|engineering|checklist)/[a-z0-9][a-z0-9-]*$"},
251
+ "root_cause_key": {"type": "string", "pattern": "^[a-z0-9][a-z0-9-]{2,79}$"},
252
+ "root_cause": {"type": "string", "minLength": 1, "maxLength": 4096},
253
+ "priority": {"enum": ["critical", "high", "medium", "low", "none"]},
254
+ "effort": {"enum": ["small", "medium", "large", "unknown"]},
255
+ "blast_radius": {"enum": ["local", "component", "system", "organization", "unknown"]},
256
+ "assessment_candidates": {"type": "array", "minItems": 1, "maxItems": 4, "uniqueItems": true, "items": {"enum": ["advisory_pass_candidate", "advisory_fail_candidate", "needs_evidence", "not_applicable_candidate"]}},
257
+ "control_count": {"type": "integer", "minimum": 1, "maximum": 100000},
258
+ "control_ids": {"type": "array", "minItems": 1, "maxItems": 100000, "uniqueItems": true, "items": {"type": "string", "pattern": "^(PRC-[0-9]{2}-[0-9]{3}|USEQ-[A-F0-9]{8})$"}},
259
+ "task_ids": {"type": "array", "minItems": 1, "maxItems": 100000, "uniqueItems": true, "items": {"type": "string", "pattern": "^[0-9a-f]{64}$"}}
260
+ }
261
+ },
112
262
  "assertion_result": {
113
263
  "type": "object",
114
264
  "additionalProperties": false,
@@ -7,7 +7,14 @@
7
7
  "required": ["schema_version", "artifact_kind", "artifact_id", "sha256", "key_id", "algorithm", "issued_at", "verified_at", "trust_store_id", "trust_store_digest", "signature_digest", "verified"],
8
8
  "properties": {
9
9
  "schema_version": {"const": "prc.signature-verification/v0.1"},
10
- "artifact_kind": {"enum": ["pack", "adapter-registry", "catalog-bundle", "risk-exception"]},
10
+ "artifact_kind": {
11
+ "enum": [
12
+ "pack", "adapter-registry", "catalog-bundle", "risk-exception",
13
+ "control-policy-bundle", "control-evidence-repository", "control-evidence-artifact",
14
+ "control-evidence-executed", "control-evidence-environment",
15
+ "control-evidence-external-registry", "control-evidence-structured-record"
16
+ ]
17
+ },
11
18
  "artifact_id": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9./@_-]{0,255}$"},
12
19
  "sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"},
13
20
  "key_id": {"type": "string", "pattern": "^[a-z0-9][a-z0-9.-]{0,127}$"},
@@ -7,7 +7,14 @@
7
7
  "required": ["schema_version", "artifact_kind", "artifact_id", "sha256", "key_id", "algorithm", "issued_at", "signature"],
8
8
  "properties": {
9
9
  "schema_version": {"const": "prc.signature/v0.1"},
10
- "artifact_kind": {"enum": ["pack", "adapter-registry", "catalog-bundle", "risk-exception"]},
10
+ "artifact_kind": {
11
+ "enum": [
12
+ "pack", "adapter-registry", "catalog-bundle", "risk-exception",
13
+ "control-policy-bundle", "control-evidence-repository", "control-evidence-artifact",
14
+ "control-evidence-executed", "control-evidence-environment",
15
+ "control-evidence-external-registry", "control-evidence-structured-record"
16
+ ]
17
+ },
11
18
  "artifact_id": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9./@_-]{0,255}$"},
12
19
  "sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"},
13
20
  "key_id": {"type": "string", "pattern": "^[a-z0-9][a-z0-9.-]{0,127}$"},
@@ -17,7 +17,14 @@
17
17
  }
18
18
  },
19
19
  "$defs": {
20
- "scope": {"enum": ["pack", "adapter-registry", "catalog-bundle", "risk-exception"]},
20
+ "scope": {
21
+ "enum": [
22
+ "pack", "adapter-registry", "catalog-bundle", "risk-exception",
23
+ "control-policy-bundle", "control-evidence-repository", "control-evidence-artifact",
24
+ "control-evidence-executed", "control-evidence-environment",
25
+ "control-evidence-external-registry", "control-evidence-structured-record"
26
+ ]
27
+ },
21
28
  "key": {
22
29
  "type": "object",
23
30
  "additionalProperties": false,