@rathnasgala2/schemas 2.11.0 → 2.13.0

package/generated/java/src/main/resources/io/gala/schema/generated/schemas/build-provenance.schema.json

@@ -1,937 +0,0 @@
-{
-  "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "urn:gala:metadata:build-provenance:2.0.0",
-  "title": "Gala build-provenance contract",
-  "type": "object",
-  "required": [
-    "schemaId",
-    "schemaVersion",
-    "assertedWorkload",
-    "requiredOidcClaims",
-    "workflowFiles",
-    "actionPins",
-    "verifiedInputHandoff",
-    "unfrozenOutputHandoff",
-    "rebuildRecord",
-    "lockDigest",
-    "packageReleaseCatalogDigest",
-    "buildInputDigest",
-    "artifactId",
-    "artifactDigest",
-    "manifestDigest",
-    "sbomDigest",
-    "spdxLicenseListVersion",
-    "spdxLicenseListDigest",
-    "spdx23JsonSchemaDigest",
-    "artifactLicenseConclusions",
-    "policyReleaseId",
-    "buildPolicyDecisionDigest",
-    "capabilityDecisionDigest",
-    "stylingContractDigest",
-    "renderPolicy",
-    "sandbox",
-    "secretInputs"
-  ],
-  "properties": {
-    "schemaId": { "const": "urn:gala:metadata:build-provenance:2.0.0" },
-    "schemaVersion": { "const": "2.0.0" },
-    "assertedWorkload": { "$ref": "#/$defs/assertedWorkload" },
-    "requiredOidcClaims": {
-      "const": [
-        "actor",
-        "actor_id",
-        "aud",
-        "event_name",
-        "iss",
-        "job_workflow_ref",
-        "job_workflow_sha",
-        "jti",
-        "ref",
-        "repository",
-        "repository_id",
-        "repository_owner",
-        "repository_owner_id",
-        "run_attempt",
-        "run_id",
-        "run_number",
-        "runner_environment",
-        "sha",
-        "sub",
-        "workflow_ref",
-        "workflow_sha"
-      ]
-    },
-    "workflowFiles": {
-      "type": "array",
-      "prefixItems": [
-        {
-          "allOf": [
-            { "$ref": "#/$defs/workflowFileEvidence" },
-            {
-              "properties": {
-                "role": { "const": "author-caller" },
-                "path": { "const": ".github/workflows/gala-publish-v2.yml" },
-                "identitySource": { "const": "declared-graph" }
-              }
-            }
-          ]
-        },
-        {
-          "allOf": [
-            { "$ref": "#/$defs/workflowFileEvidence" },
-            {
-              "properties": {
-                "role": { "const": "publish" },
-                "path": { "const": ".github/workflows/publish-v2.yml" },
-                "identitySource": { "const": "locked-release" }
-              }
-            }
-          ]
-        },
-        {
-          "allOf": [
-            { "$ref": "#/$defs/workflowFileEvidence" },
-            {
-              "properties": {
-                "role": { "const": "authorize" },
-                "path": { "const": ".github/workflows/authorize-v2.yml" },
-                "identitySource": { "const": "locked-release" }
-              }
-            }
-          ]
-        },
-        {
-          "allOf": [
-            { "$ref": "#/$defs/workflowFileEvidence" },
-            {
-              "properties": {
-                "role": { "const": "report" },
-                "path": { "const": ".github/workflows/report-v2.yml" },
-                "identitySource": { "const": "locked-release" }
-              }
-            }
-          ]
-        }
-      ],
-      "items": false,
-      "minItems": 4,
-      "maxItems": 4
-    },
-    "actionPins": {
-      "type": "array",
-      "items": { "$ref": "#/$defs/actionPinEvidence" },
-      "minItems": 1,
-      "maxItems": 32,
-      "uniqueItems": true
-    },
-    "verifiedInputHandoff": {
-      "allOf": [
-        { "$ref": "#/$defs/workflowCarrierEvidence" },
-        { "properties": { "purpose": { "const": "verified-inputs" } } }
-      ]
-    },
-    "unfrozenOutputHandoff": {
-      "allOf": [
-        { "$ref": "#/$defs/workflowCarrierEvidence" },
-        { "properties": { "purpose": { "const": "unfrozen-output" } } }
-      ]
-    },
-    "rebuildRecord": { "$ref": "#/$defs/reproducibleBuildRecord" },
-    "lockDigest": { "$ref": "#/$defs/digest" },
-    "packageReleaseCatalogDigest": { "$ref": "#/$defs/digest" },
-    "buildInputDigest": { "$ref": "#/$defs/digest" },
-    "artifactId": { "$ref": "#/$defs/stableId" },
-    "artifactDigest": { "$ref": "#/$defs/digest" },
-    "manifestDigest": { "$ref": "#/$defs/digest" },
-    "sbomDigest": { "$ref": "#/$defs/digest" },
-    "spdxLicenseListVersion": { "$ref": "#/$defs/semver" },
-    "spdxLicenseListDigest": { "$ref": "#/$defs/digest" },
-    "spdx23JsonSchemaDigest": { "$ref": "#/$defs/digest" },
-    "artifactLicenseConclusions": {
-      "type": "array",
-      "items": { "$ref": "#/$defs/artifactLicenseConclusion" },
-      "minItems": 1,
-      "maxItems": 200000,
-      "uniqueItems": true
-    },
-    "policyReleaseId": { "$ref": "#/$defs/stableId" },
-    "buildPolicyDecisionDigest": { "$ref": "#/$defs/digest" },
-    "capabilityDecisionDigest": { "$ref": "#/$defs/digest" },
-    "stylingContractDigest": { "$ref": "#/$defs/digest" },
-    "renderPolicy": { "$ref": "#/$defs/renderPolicyIdentity" },
-    "sandbox": { "$ref": "#/$defs/buildSandboxEvidence" },
-    "secretInputs": { "const": [] }
-  },
-  "additionalProperties": false,
-  "$defs": {
-    "stableId": {
-      "type": "string",
-      "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$",
-      "description": "Lowercase canonical UUIDv7. Once published, it is immutable; its time ordering conveys neither chronology nor authority."
-    },
-    "slug": {
-      "type": "string",
-      "minLength": 1,
-      "maxLength": 80,
-      "pattern": "^[a-z0-9]+(?:-[a-z0-9]+)*$"
-    },
-    "repoRelativePath": {
-      "type": "string",
-      "minLength": 1,
-      "maxLength": 512,
-      "pattern": "^(?!/)(?!.*\\\\)(?!.*\\u0000).+$",
-      "format": "gala-repository-relative-path",
-      "x-gala-utf8ByteLength": { "maximum": 512 },
-      "description": "NFC UTF-8 repository-relative path using slash separators, with no leading slash, dot segment, NUL, backslash, or percent-decoded traversal."
-    },
-    "canonicalRoute": {
-      "type": "string",
-      "minLength": 1,
-      "pattern": "^/(?!/)(?!.*//)(?!.*[?#]).*$",
-      "format": "gala-canonical-route",
-      "description": "Absolute normalized route with no query, fragment, dot segment, double slash, or non-normalized percent encoding."
-    },
-    "gitObjectId": {
-      "type": "string",
-      "pattern": "^(?:sha1:[0-9a-f]{40}|sha256:[0-9a-f]{64})$"
-    },
-    "digest": { "type": "string", "pattern": "^sha256:[0-9a-f]{64}$" },
-    "urlHttps": {
-      "type": "string",
-      "format": "uri",
-      "pattern": "^https://(?![^/?#]*@)",
-      "description": "Absolute HTTPS URL without embedded credentials."
-    },
-    "bcp47": {
-      "type": "string",
-      "minLength": 1,
-      "maxLength": 255,
-      "pattern": "^[A-Za-z0-9-]+$",
-      "format": "gala-bcp47",
-      "x-gala-utf8ByteLength": { "minimum": 1, "maximum": 255 },
-      "description": "Structurally valid canonical BCP-47 language tag."
-    },
-    "isoCountry": {
-      "type": "string",
-      "pattern": "^[A-Z]{2}$",
-      "format": "gala-iso-country",
-      "description": "ISO 3166-1 alpha-2 country code; admission remains subject to the active policy profile."
-    },
-    "plainLabel": {
-      "type": "string",
-      "format": "gala-plain-label",
-      "x-gala-graphemeLength": { "minimum": 1, "maximum": 80 },
-      "description": "Normalized Unicode plain text without markup, controls, or bidi overrides."
-    },
-    "plainText": {
-      "type": "string",
-      "format": "gala-plain-text",
-      "description": "NFC Unicode text without disallowed C0/C1 controls or bidi override/isolate controls."
-    },
-    "rfc3339": {
-      "type": "string",
-      "format": "date-time",
-      "pattern": "^[0-9]{4}-(?:0[1-9]|1[0-2])-(?:0[1-9]|[12][0-9]|3[01])T(?:[01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]\\.[0-9]{3}Z$",
-      "description": "Canonical Gala UTC millisecond subset of RFC 3339."
-    },
-    "semver": {
-      "type": "string",
-      "pattern": "^(?:0|[1-9]\\d*)\\.(?:0|[1-9]\\d*)\\.(?:0|[1-9]\\d*)(?:-(?:0|[1-9]\\d*|\\d*[A-Za-z-][0-9A-Za-z-]*)(?:\\.(?:0|[1-9]\\d*|\\d*[A-Za-z-][0-9A-Za-z-]*))*)?$",
-      "description": "Canonical SemVer 2.0.0 without build metadata."
-    },
-    "semverRange": {
-      "type": "string",
-      "minLength": 1,
-      "pattern": "^(?:\\S+|\\S+ \\S+)$",
-      "format": "gala-semver-range",
-      "description": "Whitespace-free npm-compatible exact, caret, or bounded comparator-set range; tags and URLs are invalid."
-    },
-    "packageRange": {
-      "type": "string",
-      "minLength": 3,
-      "pattern": "^(?:@[a-z0-9](?:[a-z0-9._-]*[a-z0-9])?/[a-z0-9](?:[a-z0-9._-]*[a-z0-9])?|[a-z0-9](?:[a-z0-9._-]*[a-z0-9])?)@(?:\\S+|\\S+ \\S+)$",
-      "format": "gala-package-range",
-      "description": "Lowercase npm package identity and admitted semver range; Git, file, URL, and alias sources are invalid."
-    },
-    "packageExact": {
-      "type": "string",
-      "minLength": 3,
-      "pattern": "^(?:@[a-z0-9](?:[a-z0-9._-]*[a-z0-9])?/[a-z0-9](?:[a-z0-9._-]*[a-z0-9])?|[a-z0-9](?:[a-z0-9._-]*[a-z0-9])?)@\\S+$",
-      "format": "gala-package-exact",
-      "description": "Lowercase npm package identity and exact canonical semantic version; aliases are invalid."
-    },
-    "urn": {
-      "type": "string",
-      "minLength": 10,
-      "maxLength": 255,
-      "format": "uri",
-      "pattern": "^urn:gala:[\\x21-\\x7E]+$",
-      "description": "Absolute ASCII URN in the schema-declared Gala namespace."
-    },
-    "glob": {
-      "type": "string",
-      "minLength": 1,
-      "maxLength": 256,
-      "format": "gala-repository-glob",
-      "x-gala-utf8ByteLength": { "maximum": 256 },
-      "description": "Repository-relative POSIX glob using only star, globstar, and question-mark operators; braces, extglobs, negation, absolute paths, and parent traversal are invalid."
-    },
-    "passiveVisualToken": false,
-    "extensionKey": {
-      "type": "string",
-      "format": "gala-extension-key",
-      "description": "Reverse-DNS extension namespace that cannot shadow a core key."
-    },
-    "npmPackageName": {
-      "type": "string",
-      "minLength": 1,
-      "maxLength": 214,
-      "pattern": "^(?:[a-z0-9][a-z0-9._-]*|@[a-z0-9][a-z0-9._-]*/[a-z0-9][a-z0-9._-]*)$",
-      "x-gala-utf8ByteLength": { "maximum": 214 }
-    },
-    "int64": {
-      "type": "string",
-      "pattern": "^(?:0|-?[1-9][0-9]*)$",
-      "format": "gala-int64",
-      "description": "Canonical signed 64-bit decimal string; range is checked by the semantic validator."
-    },
-    "nonNegativeInt64": {
-      "type": "string",
-      "pattern": "^(?:0|[1-9][0-9]*)$",
-      "format": "gala-int64",
-      "description": "Canonical non-negative signed-64-bit decimal string; range is checked by the semantic validator."
-    },
-    "positiveInt64": {
-      "type": "string",
-      "pattern": "^[1-9][0-9]*$",
-      "format": "gala-int64",
-      "description": "Canonical positive signed-64-bit decimal string; range is checked by the semantic validator."
-    },
-    "spdxExpression": {
-      "type": "string",
-      "minLength": 1,
-      "maxLength": 128,
-      "pattern": "^[\\x20-\\x7E]+$",
-      "format": "gala-spdx-expression",
-      "x-gala-utf8ByteLength": { "minimum": 1, "maximum": 128 }
-    },
-    "githubPositiveDecimal": {
-      "type": "string",
-      "minLength": 1,
-      "maxLength": 20,
-      "pattern": "^[1-9][0-9]{0,19}$",
-      "format": "gala-github-positive-uint64"
-    },
-    "githubActionsArtifactId": {
-      "type": "string",
-      "minLength": 1,
-      "maxLength": 20,
-      "pattern": "^[1-9][0-9]{0,19}$",
-      "format": "gala-github-positive-uint64"
-    },
-    "githubRepositoryCoordinate": {
-      "type": "string",
-      "minLength": 3,
-      "maxLength": 140,
-      "pattern": "^[A-Za-z0-9](?:[A-Za-z0-9-]{0,37}[A-Za-z0-9])?/[A-Za-z0-9._-]{1,100}$",
-      "not": { "pattern": "^[^/]+/\\.{1,2}$" },
-      "format": "gala-github-repository-coordinate",
-      "x-gala-utf8ByteLength": { "minimum": 3, "maximum": 140 }
-    },
-    "githubActorLogin": {
-      "type": "string",
-      "minLength": 1,
-      "maxLength": 100,
-      "pattern": "^(?:[A-Za-z0-9](?:[A-Za-z0-9-]{0,98}[A-Za-z0-9])?|[A-Za-z0-9](?:[A-Za-z0-9-]{0,92}[A-Za-z0-9])?\\[bot\\])$",
-      "x-gala-utf8ByteLength": { "minimum": 1, "maximum": 100 }
-    },
-    "provenanceRef": {
-      "type": "string",
-      "minLength": 1,
-      "maxLength": 512,
-      "pattern": "^[\\x20-\\x7E]+$",
-      "x-gala-utf8ByteLength": { "minimum": 1, "maximum": 512 }
-    },
-    "githubActionCoordinate": {
-      "type": "string",
-      "minLength": 44,
-      "maxLength": 512,
-      "pattern": "^[A-Za-z0-9][A-Za-z0-9-]*/[A-Za-z0-9._-]+(?:/[^@]+)?@[0-9a-f]{40}$",
-      "format": "gala-github-action-coordinate",
-      "x-gala-utf8ByteLength": { "minimum": 44, "maximum": 512 }
-    },
-    "packageIdentity": {
-      "type": "object",
-      "required": ["package", "version", "integrity", "registry"],
-      "properties": {
-        "package": { "$ref": "#/$defs/npmPackageName" },
-        "version": { "$ref": "#/$defs/semver" },
-        "integrity": { "$ref": "#/$defs/digest" },
-        "registry": { "$ref": "#/$defs/urlHttps" }
-      },
-      "additionalProperties": false
-    },
-    "manifestSourceIdentity": {
-      "type": "object",
-      "required": [
-        "provider",
-        "repository",
-        "repositoryId",
-        "repositoryOwnerId",
-        "commit",
-        "treeDigest"
-      ],
-      "properties": {
-        "provider": { "const": "github" },
-        "repository": { "$ref": "#/$defs/githubRepositoryCoordinate" },
-        "repositoryId": { "$ref": "#/$defs/githubPositiveDecimal" },
-        "repositoryOwnerId": { "$ref": "#/$defs/githubPositiveDecimal" },
-        "commit": { "$ref": "#/$defs/gitObjectId" },
-        "treeDigest": { "$ref": "#/$defs/digest" }
-      },
-      "additionalProperties": false
-    },
-    "manifestCompositionIdentity": {
-      "type": "object",
-      "required": [
-        "schemas",
-        "template",
-        "theme",
-        "publisher",
-        "enabledModuleConfigurationDigests"
-      ],
-      "properties": {
-        "schemas": {
-          "allOf": [
-            { "$ref": "#/$defs/packageIdentity" },
-            {
-              "properties": { "package": { "const": "@rathnasgala2/schemas" } }
-            }
-          ]
-        },
-        "template": {
-          "allOf": [
-            { "$ref": "#/$defs/packageIdentity" },
-            {
-              "properties": { "package": { "const": "@rathnasgala2/template" } }
-            }
-          ]
-        },
-        "theme": {
-          "allOf": [
-            { "$ref": "#/$defs/packageIdentity" },
-            {
-              "properties": {
-                "package": {
-                  "enum": [
-                    "@rathnasgala2/theme-default",
-                    "@rathnasgala2/theme-amaze",
-                    "@rathnasgala2/theme-flashy",
-                    "@rathnasgala2/theme-minimal",
-                    "@rathnasgala2/theme-zebra"
-                  ]
-                }
-              }
-            }
-          ]
-        },
-        "publisher": {
-          "type": "array",
-          "prefixItems": [
-            {
-              "allOf": [
-                { "$ref": "#/$defs/packageIdentity" },
-                {
-                  "properties": {
-                    "package": { "const": "@rathnasgala2/publish-action" }
-                  }
-                }
-              ]
-            },
-            {
-              "allOf": [
-                { "$ref": "#/$defs/packageIdentity" },
-                {
-                  "properties": {
-                    "package": { "const": "@rathnasgala2/publish-kernel" }
-                  }
-                }
-              ]
-            },
-            {
-              "allOf": [
-                { "$ref": "#/$defs/packageIdentity" },
-                {
-                  "properties": {
-                    "package": { "const": "@rathnasgala2/adapter-protocol" }
-                  }
-                }
-              ]
-            },
-            {
-              "allOf": [
-                { "$ref": "#/$defs/packageIdentity" },
-                {
-                  "properties": {
-                    "package": {
-                      "enum": [
-                        "@rathnasgala2/adapter-local-directory",
-                        "@rathnasgala2/adapter-github-pages",
-                        "@rathnasgala2/adapter-do-spaces"
-                      ]
-                    }
-                  }
-                }
-              ]
-            }
-          ],
-          "items": false,
-          "minItems": 4,
-          "maxItems": 4
-        },
-        "enabledModuleConfigurationDigests": { "const": [] }
-      },
-      "additionalProperties": false
-    },
-    "manifestRedirect": {
-      "type": "object",
-      "required": [
-        "sourceRoute",
-        "targetRoute",
-        "status",
-        "backingPath",
-        "sha256"
-      ],
-      "properties": {
-        "sourceRoute": { "$ref": "#/$defs/canonicalRoute" },
-        "targetRoute": { "$ref": "#/$defs/canonicalRoute" },
-        "status": { "const": 200 },
-        "backingPath": { "$ref": "#/$defs/repoRelativePath" },
-        "sha256": { "$ref": "#/$defs/digest" }
-      },
-      "additionalProperties": false
-    },
-    "manifestIncludedSource": {
-      "type": "object",
-      "required": ["path", "sha256", "sourceRevision", "role"],
-      "properties": {
-        "path": { "$ref": "#/$defs/repoRelativePath" },
-        "sha256": { "$ref": "#/$defs/digest" },
-        "sourceRevision": { "$ref": "#/$defs/gitObjectId" },
-        "role": {
-          "enum": [
-            "publication",
-            "author",
-            "content",
-            "navigation",
-            "appearance",
-            "asset"
-          ]
-        }
-      },
-      "additionalProperties": false
-    },
-    "manifestExcludedInput": {
-      "type": "object",
-      "required": ["path", "sha256", "ruleId", "reason"],
-      "properties": {
-        "path": { "$ref": "#/$defs/repoRelativePath" },
-        "sha256": { "$ref": "#/$defs/digest" },
-        "ruleId": { "$ref": "#/$defs/plainLabel" },
-        "reason": {
-          "enum": [
-            "not-referenced-by-build-input",
-            "deferred-capability-absent",
-            "non-artifact-source",
-            "policy-excluded"
-          ]
-        }
-      },
-      "additionalProperties": false
-    },
-    "manifestValidationEvidence": {
-      "type": "object",
-      "required": ["profile", "version", "findingCount", "evidenceDigest"],
-      "properties": {
-        "profile": { "const": "gala-artifact-validation-v2" },
-        "version": { "const": "2.0.0" },
-        "findingCount": { "type": "integer", "minimum": 0, "maximum": 10000 },
-        "evidenceDigest": { "$ref": "#/$defs/digest" }
-      },
-      "additionalProperties": false
-    },
-    "buildToolIdentity": {
-      "oneOf": [
-        {
-          "type": "object",
-          "required": ["kind", "name", "version", "digest"],
-          "properties": {
-            "kind": { "const": "runtime" },
-            "name": { "enum": ["node", "npm"] },
-            "version": { "$ref": "#/$defs/semver" },
-            "digest": { "$ref": "#/$defs/digest" }
-          },
-          "additionalProperties": false
-        },
-        {
-          "type": "object",
-          "required": ["kind", "package", "version", "digest"],
-          "properties": {
-            "kind": { "const": "package" },
-            "package": { "$ref": "#/$defs/npmPackageName" },
-            "version": { "$ref": "#/$defs/semver" },
-            "digest": { "$ref": "#/$defs/digest" }
-          },
-          "additionalProperties": false
-        }
-      ]
-    },
-    "manifestRoute": {
-      "type": "object",
-      "required": [
-        "path",
-        "mediaType",
-        "byteLength",
-        "sha256",
-        "routeClass",
-        "interactionBearing"
-      ],
-      "properties": {
-        "path": { "$ref": "#/$defs/repoRelativePath" },
-        "mediaType": {
-          "enum": [
-            "text/html; charset=utf-8",
-            "text/css; charset=utf-8",
-            "text/plain; charset=utf-8",
-            "application/javascript; charset=utf-8",
-            "application/json; charset=utf-8",
-            "application/manifest+json; charset=utf-8",
-            "application/atom+xml; charset=utf-8",
-            "application/rss+xml; charset=utf-8",
-            "application/xml; charset=utf-8",
-            "image/png",
-            "image/jpeg",
-            "image/webp",
-            "image/avif",
-            "image/svg+xml",
-            "font/woff2",
-            "application/octet-stream"
-          ]
-        },
-        "byteLength": { "$ref": "#/$defs/nonNegativeInt64" },
-        "sha256": { "$ref": "#/$defs/digest" },
-        "routeClass": { "enum": ["html", "feed", "sitemap", "asset", "error"] },
-        "stableContentId": { "$ref": "#/$defs/stableId" },
-        "sourceRevision": { "$ref": "#/$defs/gitObjectId" },
-        "interactionBearing": { "const": false }
-      },
-      "additionalProperties": false
-    },
-    "manifestAsset": {
-      "type": "object",
-      "required": ["path", "mediaType", "byteLength", "sha256", "immutable"],
-      "properties": {
-        "path": { "$ref": "#/$defs/repoRelativePath" },
-        "mediaType": {
-          "enum": [
-            "text/html; charset=utf-8",
-            "text/css; charset=utf-8",
-            "text/plain; charset=utf-8",
-            "application/javascript; charset=utf-8",
-            "application/json; charset=utf-8",
-            "application/manifest+json; charset=utf-8",
-            "application/atom+xml; charset=utf-8",
-            "application/rss+xml; charset=utf-8",
-            "application/xml; charset=utf-8",
-            "image/png",
-            "image/jpeg",
-            "image/webp",
-            "image/avif",
-            "image/svg+xml",
-            "font/woff2",
-            "application/octet-stream"
-          ]
-        },
-        "byteLength": { "$ref": "#/$defs/nonNegativeInt64" },
-        "sha256": { "$ref": "#/$defs/digest" },
-        "immutable": { "type": "boolean" }
-      },
-      "additionalProperties": false
-    },
-    "finding": {
-      "type": "object",
-      "required": ["code", "severity", "pointer", "messageKey"],
-      "properties": {
-        "code": { "$ref": "#/$defs/plainLabel" },
-        "severity": { "enum": ["error", "warning", "info"] },
-        "pointer": { "type": "string", "minLength": 1, "maxLength": 1024 },
-        "messageKey": { "$ref": "#/$defs/plainLabel" }
-      },
-      "additionalProperties": false
-    },
-    "measurement": {
-      "type": "object",
-      "required": ["name", "unit", "value"],
-      "properties": {
-        "name": { "$ref": "#/$defs/plainLabel" },
-        "unit": { "$ref": "#/$defs/plainLabel" },
-        "value": { "$ref": "#/$defs/int64" }
-      },
-      "additionalProperties": false
-    },
-    "renderPolicyIdentity": {
-      "type": "object",
-      "required": ["name", "version", "digest"],
-      "properties": {
-        "name": { "const": "gala-render-policy" },
-        "version": { "$ref": "#/$defs/semver" },
-        "digest": { "$ref": "#/$defs/digest" }
-      },
-      "additionalProperties": false
-    },
-    "assertedWorkload": {
-      "type": "object",
-      "required": [
-        "repository",
-        "repositoryId",
-        "repositoryOwner",
-        "repositoryOwnerId",
-        "ref",
-        "sourceCommit",
-        "workflowTriggerCommit",
-        "runId",
-        "runNumber",
-        "runAttempt",
-        "eventName",
-        "actor",
-        "actorId",
-        "callerPath",
-        "verificationState"
-      ],
-      "properties": {
-        "repository": { "$ref": "#/$defs/githubRepositoryCoordinate" },
-        "repositoryId": { "$ref": "#/$defs/githubPositiveDecimal" },
-        "repositoryOwner": { "$ref": "#/$defs/plainLabel" },
-        "repositoryOwnerId": { "$ref": "#/$defs/githubPositiveDecimal" },
-        "ref": { "$ref": "#/$defs/provenanceRef" },
-        "sourceCommit": { "$ref": "#/$defs/gitObjectId" },
-        "workflowTriggerCommit": { "$ref": "#/$defs/gitObjectId" },
-        "runId": { "$ref": "#/$defs/githubPositiveDecimal" },
-        "runNumber": { "$ref": "#/$defs/githubPositiveDecimal" },
-        "runAttempt": { "type": "integer", "minimum": 1, "maximum": 51 },
-        "eventName": { "enum": ["create", "workflow_dispatch"] },
-        "actor": { "$ref": "#/$defs/githubActorLogin" },
-        "actorId": { "$ref": "#/$defs/githubPositiveDecimal" },
-        "callerPath": { "const": ".github/workflows/gala-publish-v2.yml" },
-        "verificationState": { "const": "pending-authorize-oidc" }
-      },
-      "additionalProperties": false
-    },
-    "workflowFileEvidence": {
-      "type": "object",
-      "required": [
-        "role",
-        "repositoryId",
-        "path",
-        "commit",
-        "fileDigest",
-        "identitySource"
-      ],
-      "properties": {
-        "role": { "enum": ["author-caller", "publish", "authorize", "report"] },
-        "repositoryId": { "$ref": "#/$defs/githubPositiveDecimal" },
-        "path": { "$ref": "#/$defs/repoRelativePath" },
-        "commit": { "$ref": "#/$defs/gitObjectId" },
-        "fileDigest": { "$ref": "#/$defs/digest" },
-        "identitySource": { "enum": ["declared-graph", "locked-release"] }
-      },
-      "additionalProperties": false
-    },
-    "actionPinEvidence": {
-      "type": "object",
-      "required": ["use", "commit", "actionDefinitionDigest"],
-      "properties": {
-        "use": { "$ref": "#/$defs/githubActionCoordinate" },
-        "commit": { "$ref": "#/$defs/gitObjectId" },
-        "actionDefinitionDigest": { "$ref": "#/$defs/digest" }
-      },
-      "additionalProperties": false
-    },
-    "workflowCarrierEvidence": {
-      "type": "object",
-      "required": [
-        "purpose",
-        "artifactId",
-        "name",
-        "byteCount",
-        "digest",
-        "expiresAt"
-      ],
-      "properties": {
-        "purpose": { "enum": ["verified-inputs", "unfrozen-output"] },
-        "artifactId": { "$ref": "#/$defs/githubActionsArtifactId" },
-        "name": { "$ref": "#/$defs/plainLabel" },
-        "byteCount": { "$ref": "#/$defs/nonNegativeInt64" },
-        "digest": { "$ref": "#/$defs/digest" },
-        "expiresAt": { "$ref": "#/$defs/rfc3339" }
-      },
-      "additionalProperties": false
-    },
-    "artifactLicenseConclusion": {
-      "type": "object",
-      "required": ["artifactPath", "licenseConcluded", "sourceKind"],
-      "properties": {
-        "artifactPath": { "$ref": "#/$defs/repoRelativePath" },
-        "licenseConcluded": {
-          "type": "string",
-          "minLength": 1,
-          "maxLength": 128
-        },
-        "sourceKind": { "enum": ["generated", "theme-passive-asset"] },
-        "themeAssetPath": { "$ref": "#/$defs/repoRelativePath" }
-      },
-      "additionalProperties": false,
-      "allOf": [
-        {
-          "if": {
-            "properties": { "sourceKind": { "const": "generated" } },
-            "required": ["sourceKind"]
-          },
-          "then": {
-            "properties": { "licenseConcluded": { "const": "NOASSERTION" } },
-            "not": { "required": ["themeAssetPath"] }
-          },
-          "else": {
-            "properties": {
-              "licenseConcluded": { "$ref": "#/$defs/spdxExpression" }
-            },
-            "required": ["themeAssetPath"]
-          }
-        }
-      ]
-    },
-    "reproducibleBuildRecord": {
-      "type": "object",
-      "required": [
-        "repositoryId",
-        "sourceCommit",
-        "sourceTree",
-        "repositoryRootDigest",
-        "buildEpoch",
-        "contractVersion",
-        "builder",
-        "schemas",
-        "template",
-        "theme",
-        "dependencyLockDigest",
-        "packageReleaseCatalogDigest",
-        "buildInputDigest",
-        "baseUrl",
-        "basePath",
-        "destinationCapabilityDigest",
-        "policyReleaseId",
-        "buildPolicyDecisionDigest",
-        "stylingContractDigest",
-        "renderPolicy",
-        "workflowIdentity"
-      ],
-      "properties": {
-        "repositoryId": { "$ref": "#/$defs/githubPositiveDecimal" },
-        "sourceCommit": { "$ref": "#/$defs/gitObjectId" },
-        "sourceTree": { "$ref": "#/$defs/gitObjectId" },
-        "repositoryRootDigest": { "$ref": "#/$defs/digest" },
-        "buildEpoch": { "$ref": "#/$defs/rfc3339" },
-        "contractVersion": { "const": "2.0.0" },
-        "builder": {
-          "allOf": [
-            { "$ref": "#/$defs/packageIdentity" },
-            {
-              "properties": {
-                "package": { "const": "@rathnasgala2/publish-action" }
-              }
-            }
-          ]
-        },
-        "schemas": {
-          "allOf": [
-            { "$ref": "#/$defs/packageIdentity" },
-            {
-              "properties": { "package": { "const": "@rathnasgala2/schemas" } }
-            }
-          ]
-        },
-        "template": {
-          "allOf": [
-            { "$ref": "#/$defs/packageIdentity" },
-            {
-              "properties": { "package": { "const": "@rathnasgala2/template" } }
-            }
-          ]
-        },
-        "theme": {
-          "allOf": [
-            { "$ref": "#/$defs/packageIdentity" },
-            {
-              "properties": {
-                "package": {
-                  "enum": [
-                    "@rathnasgala2/theme-default",
-                    "@rathnasgala2/theme-amaze",
-                    "@rathnasgala2/theme-flashy",
-                    "@rathnasgala2/theme-minimal",
-                    "@rathnasgala2/theme-zebra"
-                  ]
-                }
-              }
-            }
-          ]
-        },
-        "dependencyLockDigest": { "$ref": "#/$defs/digest" },
-        "packageReleaseCatalogDigest": { "$ref": "#/$defs/digest" },
-        "buildInputDigest": { "$ref": "#/$defs/digest" },
-        "baseUrl": { "$ref": "#/$defs/urlHttps" },
-        "basePath": { "$ref": "#/$defs/canonicalRoute" },
-        "destinationCapabilityDigest": { "$ref": "#/$defs/digest" },
-        "policyReleaseId": { "$ref": "#/$defs/stableId" },
-        "buildPolicyDecisionDigest": { "$ref": "#/$defs/digest" },
-        "stylingContractDigest": { "$ref": "#/$defs/digest" },
-        "renderPolicy": { "$ref": "#/$defs/renderPolicyIdentity" },
-        "workflowIdentity": { "$ref": "#/$defs/digest" }
-      },
-      "additionalProperties": false
-    },
-    "buildSandboxEvidence": {
-      "type": "object",
-      "required": [
-        "runnerEnvironment",
-        "runnerImageRelease",
-        "runnerImageReleaseDigest",
-        "nodeVersion",
-        "nodeExecutableDigest",
-        "npmVersion",
-        "npmExecutableDigest",
-        "locale",
-        "timezone",
-        "sourceDateEpoch",
-        "networkPolicyDigest",
-        "filesystemPolicyDigest"
-      ],
-      "properties": {
-        "runnerEnvironment": { "const": "github-hosted" },
-        "runnerImageRelease": { "$ref": "#/$defs/plainLabel" },
-        "runnerImageReleaseDigest": { "$ref": "#/$defs/digest" },
-        "nodeVersion": { "const": "24.18.0" },
-        "nodeExecutableDigest": { "$ref": "#/$defs/digest" },
-        "npmVersion": { "const": "11.16.0" },
-        "npmExecutableDigest": { "$ref": "#/$defs/digest" },
-        "locale": { "const": "C.UTF-8" },
-        "timezone": { "const": "UTC" },
-        "sourceDateEpoch": { "$ref": "#/$defs/rfc3339" },
-        "networkPolicyDigest": { "$ref": "#/$defs/digest" },
-        "filesystemPolicyDigest": { "$ref": "#/$defs/digest" }
-      },
-      "additionalProperties": false
-    }
-  },
-  "$comment": "Exactly DEC-097 section \"Build provenance and verified workload binding\" (2198-2228). Cross-record identity equalities, exact action/workflow closure, digest preimages, carrier observations, license coverage, and byte-identical rebuild predicates are enforced by validateFrozenEnvelope, the same semantic validator that enforces the identical nested #/$defs/buildProvenance copy inside artifact-manifest."
-}