@thebackstoryis/engineering-with-ai 0.2.9

package/LICENSE

@@ -0,0 +1,165 @@
+Backstory Group Source-Available Licence 1.0
+
+Copyright (c) 2026 Backstory Group Limited (www.backstorygroup.co.uk)
+All rights reserved.
+
+This licence is a source-available licence. It is not an open-source licence.
+
+1. Definitions
+
+"Backstory Group", "we", "us" and "our" mean Backstory Group Limited.
+
+"EWAI" means the Engineering With AI software, including its source code,
+runtime, command-line tools, dashboard, documentation, templates and other
+materials distributed with it.
+
+"Official Package" means an unmodified release of EWAI published by Backstory
+Group through npm or another channel that we identify as official.
+
+"Project Content" means the source code, specifications, documentation,
+configuration, records and other material that you or your organisation create,
+provide or maintain in a project that uses EWAI.
+
+"Output" means material produced through the ordinary intended use of the
+Official Package, including generated or materialised project source code,
+specifications, plans, reports, documentation and other project artefacts.
+Output does not include EWAI itself or a Modified Version.
+
+"Extension" means independently written software that interoperates with EWAI
+through a documented or ordinarily supported interface without copying,
+modifying or incorporating any part of EWAI.
+
+"Modified Version" means EWAI, or any part of it, that has been modified,
+adapted, translated, rearranged, combined into another product, or used to
+create a derivative work.
+
+"you" means the individual or legal entity accepting this licence. People who
+work for you may use the Official Package on your behalf, provided that you
+ensure they comply with this licence.
+
+2. Permission to use the Official Package
+
+Subject to this licence, Backstory Group gives you a non-exclusive, worldwide,
+royalty-free right to install and run the Official Package for lawful personal,
+internal, professional and commercial work.
+
+This includes using the Official Package:
+
+- to design, build, test, operate and maintain commercial or non-commercial
+  software and other products;
+- in work performed for clients; and
+- alongside your own tools, Project Content and Extensions.
+
+This permission applies only to use of the Official Package. It does not give
+you permission to sell, license, host, distribute or otherwise offer EWAI
+itself, whether alone or as part of another product or service.
+
+3. Your Project Content and Output
+
+Backstory Group claims no ownership of your Project Content or Output merely
+because you used EWAI to create, examine or manage it.
+
+Subject to any rights belonging to other people, you may use, modify, license,
+publish, distribute and commercialise your Project Content and Output without
+paying Backstory Group a royalty.
+
+4. Independent Extensions and integrations
+
+You may create, use, license, distribute and commercialise Extensions.
+Interoperating with EWAI through a documented or ordinarily supported interface
+does not, by itself, make an Extension a Modified Version.
+
+An Extension must not:
+
+- copy, incorporate, modify or redistribute EWAI source code;
+- bypass technical restrictions or licence controls;
+- imply that it is made, approved or endorsed by Backstory Group without our
+  written permission; or
+- use Backstory Group trade marks except to describe truthful compatibility.
+
+5. Source transparency
+
+Where Backstory Group makes EWAI source code available, you may view and inspect
+it for transparency, evaluation, security review, compliance review and
+understanding how the Official Package works. You may make the copies that are
+technically necessary for those purposes, including a local inspection copy.
+
+Access to the source code does not give you permission to use it to create a
+Modified Version, to maintain an unofficial distribution, or to exercise any
+right not expressly granted by this licence. Any technical ability supplied by
+a source-hosting platform, including the ability to fork a repository, does not
+expand the permissions in this licence.
+
+6. Restrictions
+
+Unless Backstory Group gives you separate written permission, you must not:
+
+- modify, adapt, translate or create a derivative work from EWAI;
+- copy EWAI except as necessary to install, run, back up or inspect the Official
+  Package as expressly permitted by this licence;
+- publish, distribute, sublicense, sell, rent, lease or transfer EWAI or a
+  Modified Version;
+- repackage or rebrand EWAI;
+- make EWAI or a Modified Version available as a hosted, managed or bureau
+  service whose principal value is access to EWAI;
+- use EWAI source code to create or improve a substitute for, or competing
+  version of, EWAI;
+- remove or alter copyright, attribution, trade mark or licence notices; or
+- bypass or interfere with access, subscription, entitlement, update, security
+  or usage controls.
+
+7. Third-party materials
+
+EWAI may use or refer to third-party software, services or content. Those
+materials remain subject to their own terms. This licence does not give you any
+additional rights in them.
+
+8. No trade mark licence
+
+This licence does not grant a right to use the names, logos or trade marks of
+Backstory Group, Backstory, Engineering With AI or Conversational Coding except
+as necessary to describe truthful compatibility with an Official Package.
+
+9. Term and termination
+
+This licence continues until terminated. It terminates automatically if you
+breach it and do not remedy the breach within 30 days after receiving written
+notice from Backstory Group. A breach involving deliberate redistribution,
+repackaging, rebranding or commercial exploitation of EWAI may be terminated
+immediately.
+
+When this licence terminates, you must stop using EWAI and delete copies in your
+possession or control. Termination does not take away rights already granted in
+your Project Content or Output.
+
+10. Disclaimer of warranty
+
+EWAI is provided "as is" and "as available". To the fullest extent permitted by
+law, Backstory Group excludes all warranties, conditions and representations,
+whether express, implied or statutory, including warranties of satisfactory
+quality, fitness for a particular purpose, non-infringement, availability,
+accuracy and freedom from defects.
+
+11. Limitation of liability
+
+To the fullest extent permitted by law, Backstory Group will not be liable for
+any indirect, incidental, special, consequential or punitive loss, or for any
+loss of profit, revenue, business, goodwill, data or anticipated savings,
+arising from or connected with EWAI or this licence.
+
+Nothing in this licence excludes or limits liability that cannot lawfully be
+excluded or limited.
+
+12. Governing law
+
+This licence and any dispute or claim arising from it are governed by the laws
+of Scotland. The courts of Scotland have exclusive jurisdiction, except where
+applicable law requires otherwise.
+
+13. Separate commercial terms
+
+Backstory Group may offer separate commercial terms, including permission to
+modify, embed, redistribute or provide EWAI as part of another service. Those
+rights exist only where they are agreed in writing.
+
+For licensing enquiries, visit https://www.backstorygroup.co.uk.

package/README.md

@@ -0,0 +1,96 @@
+# Engineering With AI
+
+Engineering With AI (EWAI) helps you plan, build and review software with an AI assistant. It gives the assistant a shared record of the project, a delivery workflow and checks against your engineering standards. You keep control of the decisions and approve implementation before it starts.
+
+## Install and start
+
+You'll need Node.js 22.5 or newer, npm, and a supported AI command-line tool such as Codex or Claude Code, installed and signed in.
+
+Install EWAI, go to your project folder, then run `ewai`:
+
+```bash
+npm install --global @thebackstoryis/engineering-with-ai
+cd /path/to/your/project
+ewai
+```
+
+Replace the project path with your own. **Running `ewai` opens your AI tool and walks you through initialising the project.** If more than one supported tool is available, you'll be asked which one to use. EWAI prepares its skills automatically; you don't need to run separate `ewai install` or `ewai init` commands for this guided setup.
+
+It first asks where to keep your project's SPECS records, then helps you describe what you're building. For an existing codebase, it also offers Archaeology to recover missing documentation; you can accept or decline. You don't need to prepare those files or learn the supporting commands before starting.
+
+To return to the project, run `ewai` in the same folder again. It picks up the saved project state rather than starting setup from scratch. Keep your normal Git workflow for your application's code; EWAI itself is installed and updated through npm.
+
+If npm returns `E404`, follow [installation troubleshooting](Docs/operations/installation-updating-and-entitlements.md). That's a package-acquisition failure, not a premium-persona licence error. Don't paste licence keys into npm commands or chat.
+
+- [First session: set up a small project](Docs/tutorials/first-session.md)
+- [First delivery: work through a CSV export](Docs/tutorials/first-delivery.md)
+- [Already have a codebase?](Docs/existing-project-onboarding-guide.md) Archaeology can reconstruct missing documentation, but it's your choice whether to run it.
+- [Installation, updates and host options](Docs/operations/installation-updating-and-entitlements.md)
+
+## Start with a conversation
+
+Once EWAI opens your AI tool, describe what you need. You don't need to memorise EWAI's commands:
+
+> “Help us understand this codebase before we change it.”
+
+> “We need an export of the filtered support-ticket list. Work through the intent with us, and stop before implementation so we can review the plan.”
+
+> “Pick up the export feature and show us where we left it.”
+
+The skills inspect the project's state, choose the relevant workflow and run the supporting commands. They'll ask for missing information and your decisions. **`ewai-deliver` coordinates feature delivery through fourteen stages**, bringing in specialist skills for work such as design, test planning and review.
+
+The supporting CLI commands are available for direct control, troubleshooting and automation, but you don't need to work through them manually to use the guided workflow.
+
+## What stays in your project?
+
+**SPECS** means Scope, Purpose, Evidence, Constraints and Strategy. These readable project records hold the purpose, requirements, decisions and evidence the team has agreed. They remain useful outside an AI session.
+
+The dashboard runs locally and lets you inspect work and make supported choices. Its loopback address isn't a shared team website. The AI host does the guided work; the runtime records progress and checks the conditions for moving on. [How these parts fit together](Docs/explanation/core-concepts.md).
+
+Human judgement remains essential. A persona isn't a real stakeholder, green tests aren't human acceptance, and a delivery handoff isn't permission to deploy.
+
+## Licence
+
+The official EWAI npm package is free to use for personal, professional and
+commercial work. You can use it to build commercial products, work for clients
+and create independent integrations or extensions.
+
+The source is published for transparency and review, but EWAI is not open
+source. You may not modify, repackage, redistribute, rebrand or commercially
+exploit the EWAI core without separate written permission from Backstory Group.
+The licence does not restrict the project content or output you create by using
+EWAI. Read the [Backstory Group Source-Available Licence](LICENSE) for the full
+terms.
+
+## Choose what you need
+
+| When you want to… | Start here |
+| --- | --- |
+| Decide which work needs attention next | [Companion](Docs/context-aware-delivery-companion-user-guide.md) |
+| Describe a feature and agree its boundaries | [Intent Studio](Docs/guided-intent-workspace-guide.md) |
+| Understand how delivery moves through its stages | [The fourteen-stage workflow](Docs/explanation/delivery-workflow.md) |
+| Investigate dependencies before a change | [Source Map](Docs/repository-source-map-guide.md) and [Blast Radius](Docs/blast-radius-and-impact-routing-guide.md) |
+| Turn a meeting into reviewed project evidence | [Meeting evidence](Docs/meeting-evidence-user-guide.md) |
+| Check an implemented feature with a person | [Manual QA](Docs/quality/manual-qa-and-acceptance.md) |
+| Adapt the dashboard to your work | [Dashboard configuration](Docs/operations/dashboard-configuration.md) |
+| Use shared organisational guidance | [Blueprints](Docs/designing-organisation-blueprint-packs.md) and [rollout](Docs/organisation-rollout-guide.md) |
+
+Start with the parts your project needs. Portfolio, Team Hub and other advanced dashboard views are optional; hiding a view doesn't disable mandatory project checks.
+
+## Personas
+
+The included personas support the normal workflow. You can also create project-specific personas and use your own personal library.
+
+Premium personas are optional specialist perspectives. If you have a subscription, [enter your key privately and install the pack](Docs/operations/premium-personas-setup.md) before the analysis you want it to support. Installing a persona doesn't give it authority to approve a requirement, bypass a check or speak for a real user.
+
+## Go deeper
+
+- [User guides and learning routes](Docs/README.md)
+- [Complete guide catalogue](Docs/guide-catalogue.md)
+- [Capabilities and project layout](Docs/reference/capabilities-and-project-layout.md)
+- [Commands and configuration](Docs/reference/cli-and-configuration.md)
+- [Troubleshooting and recovery](Docs/operations/troubleshooting-and-recovery.md)
+
+## Contributing to EWAI
+
+If you're changing the harness itself, use the [contributor guide](Docs/maintainers/contributing.md) and [verification walkthroughs](Docs/maintainers/verification-walkthroughs.md). Those source-checkout and regression-test instructions aren't part of setting up your own application.

package/agents-src/claude/ewai-security-reviewer.md

@@ -0,0 +1,15 @@
+---
+name: ewai-security-reviewer
+description: Use proactively for the defensive, read-only security and trust pass during EWAI Archaeology. Review only repositories the user is authorised to assess.
+model: opus
+tools: Read, Grep, Glob, Bash
+permissionMode: plan
+---
+
+Perform an evidence-led static security and trust review inside the explicitly agreed repository boundary.
+
+Document observable authentication, authorization, tenancy, validation, output handling, secrets boundaries, sensitive-data controls, cryptography, browser and session controls, dependency and supply-chain signals, integration trust boundaries, abuse controls, failure behavior, deployment configuration, and security-test evidence.
+
+Use read-only inspection and non-destructive Git history queries. Do not search for live credentials, exploit vulnerabilities, establish persistence, evade controls, access external systems, or inspect paths outside the agreed repository. Do not run project-defined scripts or active security probes.
+
+Return evidence-backed findings with source locations, confidence, affected capabilities, missing assurance, and recommended SPECS record families. Distinguish observed vulnerabilities, defence-in-depth improvements, test gaps, configuration uncertainty, and speculative threats. This is not penetration testing, compliance certification, or a guarantee of security.

package/bin/ewai

@@ -0,0 +1,5 @@
+#!/usr/bin/env node
+import { launch } from '../src/launcher.mjs';
+
+const exitCode = await launch(process.argv.slice(2));
+if (exitCode !== 0) process.exitCode = exitCode;

package/config/archaeology-record-families.yaml

@@ -0,0 +1,59 @@
+schema: ewai.archaeology-record-families/v1
+depth: maximum-discoverable-detail
+capability_families:
+  - scope.domain-language
+  - scope.actors-and-personas
+  - scope.interfaces-and-integrations
+  - purpose.intent
+  - purpose.workflows
+  - purpose.journeys
+  - purpose.requirements
+  - purpose.acceptance-and-success
+  - evidence.tests
+  - evidence.risks
+  - evidence.incidents-and-learning
+  - constraints.rules
+  - strategy.architecture
+  - strategy.patterns
+  - strategy.decisions
+  - strategy.options-and-tradeoffs
+  - strategy.runbooks-and-operations
+  - build.delivery-history
+  - build.validation-history
+  - build.retrospective
+project_families:
+  - scope.system-context
+  - scope.domain-model
+  - scope.persona-library
+  - scope.api-event-command-catalog
+  - scope.integration-catalog
+  - purpose.project-intent
+  - purpose.journey-map
+  - purpose.requirement-index
+  - evidence.risk-register
+  - evidence.test-coverage
+  - evidence.security-review
+  - evidence.code-quality-review
+  - evidence.incident-catalog
+  - evidence.technical-debt
+  - evidence.operational-assurance
+  - constraints.engineering-standards
+  - constraints.security-privacy
+  - constraints.data-governance
+  - constraints.accessibility
+  - constraints.compliance
+  - constraints.operational
+  - strategy.technology-stack
+  - strategy.system-architecture
+  - strategy.data-architecture
+  - strategy.integration-architecture
+  - strategy.pattern-library
+  - strategy.adr-index
+  - strategy.options-register
+  - strategy.sops
+  - strategy.runbooks
+  - strategy.observability
+  - strategy.recovery-continuity
+  - build.release-deployment-history
+  - build.lifecycle-stage-reconstruction
+  - build.learning-history

package/config/delivery-artifacts.yaml

@@ -0,0 +1,121 @@
+schema: ewai.delivery-artifacts/v1
+phases:
+  ideate:
+    required:
+      - grill-ledger.md
+      - ideate-draft-intent.md
+  intent:
+    required:
+      - intent-summary.md
+      - gates/intent/intent-dependency-map.json
+      - gates/intent/intent-dependency-map-check.md
+      - gates/intent/intent-dependency-map-check.json
+      - gates/intent/intent-code-disagreements.json
+    organisation_policy:
+      required:
+        - gates/intent/organisation-policy-design.json
+  reconcile:
+    required:
+      - reconcile.md
+      - gates/reconcile/intent-dependency-map-check.md
+      - gates/reconcile/intent-dependency-map-check.json
+      - gates/reconcile/reconcile-disagreements.json
+  ui-design:
+    required:
+      - ui-design.md
+      - ui-design-assets/prototypes/manifest.json
+  plan:
+    required:
+      - build-plan.md
+      - destination.md
+      - task-graph.json
+      - gates/plan/intent-dependency-map-check.md
+      - gates/plan/intent-dependency-map-check.json
+      - gates/plan/discovery-notes.md
+      - gates/plan/code-truth-map.json
+      - gates/plan/claim-ledger.json
+      - gates/plan/claim-ledger-check.md
+      - gates/plan/claim-ledger-check.json
+      - gates/plan/implementation-flow-contract.json
+      - gates/plan/local-pattern-research.json
+      - gates/plan/plan-contract.json
+      - gates/plan/plan-contract-check.md
+      - gates/plan/plan-contract-check.json
+      - gates/plan/plan-existence-check.md
+      - gates/plan/task-graph-check.md
+      - gates/plan/task-graph-check.json
+    organisation_policy:
+      required:
+        - gates/plan/organisation-policy-design.json
+  pattern-validation:
+    required:
+      - pattern-validation.md
+      - gates/pattern-validation/implementation-flow-contract-check.json
+      - gates/pattern-validation/local-pattern-research-check.json
+      - gates/pattern-validation/claim-ledger-check.md
+      - gates/pattern-validation/claim-ledger-check.json
+      - gates/pattern-validation/plan-contract-check.md
+      - gates/pattern-validation/plan-contract-check.json
+      - gates/pattern-validation/task-graph-check.md
+      - gates/pattern-validation/task-graph-check.json
+      - gates/pattern-validation/plan-existence-check.md
+  test-plan:
+    required:
+      - test-plan.md
+      - gates/test-plan/task-to-test-traceability.md
+      - gates/test-plan/red-green-refactor-traceability.md
+      - gates/test-plan/claim-ledger-check.md
+      - gates/test-plan/claim-ledger-check.json
+      - gates/test-plan/plan-contract-check.md
+      - gates/test-plan/plan-contract-check.json
+      - gates/test-plan/plan-existence-check.md
+      - gates/test-plan/task-graph-check.md
+      - gates/test-plan/task-graph-check.json
+  validate-external-plan:
+    required:
+      - validate-external-plan/actions.md
+      - gates/validate-external-plan/plan-contract-check.md
+      - gates/validate-external-plan/plan-contract-check.json
+      - gates/validate-external-plan/plan-existence-check.md
+    validation_cycles: true
+  validate-external-test-plan:
+    required:
+      - validate-external-test-plan/actions.md
+      - gates/validate-external-test-plan/claim-ledger-check.md
+      - gates/validate-external-test-plan/claim-ledger-check.json
+      - gates/validate-external-test-plan/plan-contract-check.md
+      - gates/validate-external-test-plan/plan-contract-check.json
+    validation_cycles: true
+  fit-check:
+    required:
+      - fit-check-report.md
+  build:
+    required:
+      - delivery-checklist.md
+      - gates/build/plan-contract-check.md
+      - gates/build/plan-contract-check.json
+      - gates/build/build-contract-integrity.md
+      - gates/build/build-contract-integrity.json
+      - gates/build/task-graph-check.md
+      - gates/build/task-graph-check.json
+    task_reports: true
+  standards-sweep:
+    required:
+      - standards-sweep.md
+  test-execute:
+    required:
+      - test-execute-report.md
+  validate-external-code:
+    required:
+      - validate-external-code/actions.md
+    validation_cycles: true
+  delivery:
+    required:
+      - delivery-checklist.md
+      - qa-walkthrough.md
+      - gates/delivery/task-graph-check.md
+      - gates/delivery/task-graph-check.json
+    task_reports: true
+  retro:
+    required:
+      - retro.md

package/config/delivery-stages.yaml

@@ -0,0 +1,77 @@
+schema: ewai.delivery-stages/v1
+name: EWAI fourteen-stage delivery loop
+mission: be right, not done
+stages:
+  - number: 1
+    id: ideate
+    required: conditional
+    condition: Input is a rough idea without an approved intent.
+  - number: 2
+    id: intent
+    required: always
+  - number: 3
+    id: reconcile
+    required: conditional
+    condition: Existing implementation or inherited code is in scope.
+  - number: 4
+    id: plan
+    required: always
+  - number: 5
+    id: pattern-validation
+    required: always
+  - number: 6
+    id: test-plan
+    required: always
+  - number: 7
+    id: validate-external-plan
+    required: provider-gated
+    providers: [claude, codex, antigravity]
+    provider_policy: project-configured-independent-only
+    on_unavailable: not-supported
+  - number: 8
+    id: validate-external-test-plan
+    required: provider-gated
+    providers: [claude, codex, antigravity]
+    provider_policy: project-configured-independent-only
+    on_unavailable: not-supported
+  - number: 9
+    id: build
+    required: always
+    approval: required
+  - number: 10
+    id: standards-sweep
+    required: always
+  - number: 11
+    id: test-execute
+    required: always
+  - number: 12
+    id: validate-external-code
+    required: provider-gated
+    providers: [claude, codex, antigravity]
+    provider_policy: project-configured-independent-only
+    on_unavailable: not-supported
+  - number: 13
+    id: delivery
+    required: always
+  - number: 14
+    id: retro
+    required: always
+    after: manual-qa-approved
+adjuncts:
+  - id: ui-design
+    after: reconcile
+    condition: User-facing interface work is in scope.
+  - id: fit-check
+    before: build
+    condition: A shelved plan is being resumed and needs revalidation.
+human_gates:
+  - id: manual-qa
+    after: delivery
+    before: retro
+    required: always
+rules:
+  - A not-supported provider-gated stage remains visible and is never marked passed.
+  - The active orchestrator cannot satisfy an independent external-validation stage.
+  - Standards compliance remains required when no external validator is configured.
+  - Retro is complete only when its action plan routes accepted learning into durable assets.
+  - Project Retro may change project-local SPECS and assets; it must not mutate a global EWAI installation.

package/config/design-system.schema.json

@@ -0,0 +1,46 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://engineeringwith.ai/schemas/design-system-v1.json",
+  "type": "object",
+  "required": ["compatibility", "provenance", "contributions"],
+  "properties": {
+    "compatibility": {
+      "type": "object",
+      "required": ["ewai"],
+      "properties": {
+        "ewai": { "type": "string", "pattern": "^[0-9]+\\.x$" }
+      },
+      "additionalProperties": false
+    },
+    "provenance": {
+      "type": "object",
+      "required": ["kind", "summary"],
+      "properties": {
+        "kind": { "enum": ["owner-declared", "observed", "inferred", "adapted"] },
+        "summary": { "type": "string", "minLength": 1, "maxLength": 500 },
+        "source": { "type": "string", "minLength": 1, "maxLength": 500 }
+      },
+      "additionalProperties": false
+    },
+    "contributions": {
+      "type": "array",
+      "minItems": 1,
+      "maxItems": 200,
+      "items": {
+        "type": "object",
+        "required": ["id", "kind", "title", "source", "applicability", "required"],
+        "properties": {
+          "id": { "type": "string", "pattern": "^[a-z0-9]+(?:-[a-z0-9]+)*$" },
+          "kind": { "enum": ["experience", "principles", "foundations", "tokens", "components", "interaction", "content", "states", "responsive", "accessibility", "motion", "prohibited", "review"] },
+          "title": { "type": "string", "minLength": 1, "maxLength": 160 },
+          "source": { "type": "string", "minLength": 1, "maxLength": 240, "not": { "pattern": "(^[a-zA-Z][a-zA-Z0-9+.-]*:|^/|(^|[\\\\/])\\.\\.([\\\\/]|$))" } },
+          "applicability": { "type": "array", "minItems": 1, "maxItems": 30, "uniqueItems": true, "items": { "type": "string", "pattern": "^[a-z0-9]+(?:-[a-z0-9]+)*$" } },
+          "required": { "type": "boolean" },
+          "replaces": { "type": "array", "maxItems": 30, "uniqueItems": true, "items": { "type": "string", "pattern": "^(?:ewai\\.[a-z0-9.-]+|org\\.[a-z0-9-]+\\.[a-z0-9.-]+):[a-z0-9]+(?:-[a-z0-9]+)*$" } }
+        },
+        "additionalProperties": false
+      }
+    }
+  },
+  "additionalProperties": false
+}

package/config/error-reporting.schema.json

@@ -0,0 +1,79 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://engineeringwithai.dev/schemas/error-reporting.schema.json",
+  "title": "EWAI local error report",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schema", "id", "status", "revision", "createdAt", "updatedAt", "diagnostics", "description", "redactions", "attachments"],
+  "properties": {
+    "schema": { "const": "ewai.error-report/v1" },
+    "id": { "type": "string", "pattern": "^report_[a-z0-9_]{3,80}$" },
+    "status": { "enum": ["draft", "finalised", "archived"] },
+    "revision": { "type": "integer", "minimum": 1 },
+    "createdAt": { "type": "string", "format": "date-time" },
+    "updatedAt": { "type": "string", "format": "date-time" },
+    "diagnostics": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["capability", "errorCode", "command", "ewaiVersion", "nodeVersion", "osClass", "installationSource"],
+      "properties": {
+        "capability": { "type": "string", "pattern": "^[a-z0-9]+(?:-[a-z0-9]+)*$" },
+        "errorCode": { "type": "string", "pattern": "^[A-Z][A-Z0-9-]{2,79}$" },
+        "command": { "type": "string", "maxLength": 160 },
+        "ewaiVersion": { "type": "string", "maxLength": 40 },
+        "nodeVersion": { "type": "string", "maxLength": 40 },
+        "osClass": { "enum": ["darwin", "linux", "win32", "other"] },
+        "installationSource": { "enum": ["npm", "git", "local", "unknown"] }
+      }
+    },
+    "description": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["title", "expected", "actual", "reproductionSteps"],
+      "properties": {
+        "title": { "type": "string", "maxLength": 500 },
+        "expected": { "type": "string", "maxLength": 4000 },
+        "actual": { "type": "string", "maxLength": 4000 },
+        "reproductionSteps": { "type": "array", "maxItems": 50, "items": { "type": "string", "maxLength": 1000 } }
+      }
+    },
+    "redactions": { "$ref": "#/$defs/redactions" },
+    "attachments": {
+      "type": "array",
+      "maxItems": 20,
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["name", "size", "digest"],
+        "properties": {
+          "name": { "type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]{0,119}$" },
+          "size": { "type": "integer", "minimum": 0, "maximum": 5242880 },
+          "digest": { "type": "string", "pattern": "^sha256:[a-f0-9]{64}$" }
+        }
+      }
+    },
+    "package": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["packageDigest", "archiveDigest", "size", "memberCount"],
+      "properties": {
+        "packageDigest": { "type": "string", "pattern": "^sha256:[a-f0-9]{64}$" },
+        "archiveDigest": { "type": "string", "pattern": "^sha256:[a-f0-9]{64}$" },
+        "size": { "type": "integer", "minimum": 1 },
+        "memberCount": { "type": "integer", "minimum": 4 }
+      }
+    }
+  },
+  "$defs": {
+    "redactions": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["schema", "classes", "counts"],
+      "properties": {
+        "schema": { "const": "ewai.error-report-redactions/v1" },
+        "classes": { "type": "array", "uniqueItems": true, "items": { "type": "string" } },
+        "counts": { "type": "object", "additionalProperties": { "type": "integer", "minimum": 0 } }
+      }
+    }
+  }
+}